Problems are only with Dovecot witch is not (yet) officially supported by ISPCP. Postfix can use any method, not just PLAIN or LOGIN. Postfix do not authenticate against mysql database. Having plain password here is a security issue (and protection is not agains administrator).
Since we need to keep passwords because we need to be able to recreate emails on upgrade/domain property change. Until we will find a better solution must remain like this. Again, Dovecot is not officially supported, but since number of users seems to like it, I did come with a solution to make it work with ISPCP. Is not the best, but is working