1. Exchange mailbox permissions are stored in 2 location: Active Directory and Exchange databases. However, you can access both kinds of permissions using Active Directory User and Management MMC that you install from Exchange CD.
You can also use tools like dsacls or adfind to list who have access to particular object. However, the output of these tools may be too much for you to go through. You might need to use "find" command to filter out the output.
You can use a combination of dsquery and dsacls /r to list all mailbox and revoke the access rights. You can refer to following document for syntax of dsacls: http://go.microsoft.com/fwlink/?LinkId=61158.
You can also refer to following KB article on how to programmatically modify access rights to mailbox: http://support.microsoft.com/kb/310866/.
2.The root where Exchange object inherit it permission from depend on each organization's implementation. The permission for AD related object can be inherited from domain level or organisational unit level.
The best practice for delegating administrative permission to manage Active Directory objects or Exchange related mailbox object is to delegate the permission to a group. You can then add all the user who need specific permission to these groups and remove it when the user no longer need these rights. This will help prevent the problem of having to scan throught the entire AD to verify which object a particular user have access rights when you want to revoke the permission.