Mr Sam's post brings up some interesting topics.
The first about a buffer that needs to be cleared has already
been dealt with.
The issue about sql login being compiled in also brings up
another issue.. By putting the sql information into
a ~vpopmail/etc file it solves the issue as long as all
email domains are owned by vpopmail. If any domains
are under a non-vpopmail user, then the sql information
file needs to be readable by all. In that case I would
recomend not allowing shell access, and chrooting
ftp access to a users home directory.
what remains is the ip is opened for relay before
the password is authenticated.