I work for a small ISP that hosts e-mail for some 6,000 users, and we're in the process of upgrading to a new Debian mail server. One of the many requests we get from our users is to be able to change their e-mail passwords themselves.
In the past, we've avoided this option except for qmailadmin, which is only given to select few business customers we can trust. Generally speaking, letting users change their own e-mail passwords has been in my mind, a recipe for disaster. Not only does it mean that they are likely to use astonishingly stupid passwords, but the possibility of code errors allowing attackers to change everyone's passwords is probably pretty high.
Also, historically, we've had Webmail (Squirrelmail and Horde if you want to know) running on a separate server entirely, but many HOWTOs say to put them on the same server. Again, this is something I've avoided because I'm paranoid, but probably rightfully so. If I recall correctly, this is the biggest reason why users can't change their passwords through their own webmail.
Am I being too paranoid, or is this just the reason why noone has broken into our mail server for the past 7 years? (except the odd spammer phishing for user passwords)