I run my own mail server from colocation. I have so far refused to provide webmail because I can't find an implementation that isn't a constant stream of security holes, in exactly the way that Courier / Exim aren't.
Any recommendations? I won't use PHP or MySQL on grounds of taste and decency.