Removing user rights to their own mailbox in Exchange 2010

I have an employee whose last day with the company is today but they are moving to another role at a reseller and will continue their normal functions as a consultant, just not be a formal employee.  As such, they are being allowed to take the same workstation they've been using with them.  The user's mailbox will need to remain live and I am going to give full access to another user.  I need to disable the exiting employee's access to their own exchange mailbox without deleting the mailbox or removing the AD user account.  That way they can still access the network via the VPN but not have access to the mailbox either through Outlook or OWA.  Any ideas?