Mail and Security - Thinking about user and groups

[aseques]

The webmail application just mimics a IMAP client. So the bug should be on the IMAP server (either courier or dovecot for some), these servers with a good configuration generally are quite strong in terms of security.
Also they are using vmail:vmail for the user:group so they can drop privileges and use vmail:vmail instead of a privileged user who could write as any user (and by doing this, they avoid the risk of being used to exploit the server)