Just FYI: I also discovered this bug and tracked it down. It has nothing to do with debian and is a dovecot upstream bug.
See here: http://dovecot.org/pipermail/dovecot/2015-April/100618.html Patch: http://dovecot.org/pipermail/dovecot/attachments/20150424/bade681d/attachment.bin
pgpWrqnV69sBp.pgp
Description: OpenPGP digital signature
