I have my opensmtpd setup relay incoming mail to a Citadel IMAP/webmail server. It works a treat. I'm paranoid, so I don't allow external IMAP, force SSL on the webmail, GeoIP block it to only 3 countries and have a simple auth prompt on it as well just in case the landing page has an exploit.