Level 1 (Helpdesk) Administration and Security in Exchange 2010

In Exchange 2010, we have roles setup for our Level 1 Administrators, where they are allowed to create Exchange mailboxes, forward mail from/to Exchange Mailboxes, add aliases, add users to distro lists, etc etc.

However, we would like the ability to restrict these users from granting mailbox access to another user.

Is there a way to restrict this so that our Level 1 Administrators CANT grant full mailbox access to any one's existing Mailbox account?

Thanks in advance,