We've had a few requests for incremental backups in Virtualmin. Makes sense, as we get larger customers with bigger boxes...a full backup could be 100 GB, or more, which even on a fast network would take a long time to transfer.
Seems like a "last full backup" flag in /etc/webmin/virtual-server/domains/* or somewhere, and using find with tar would handle the backing up side. The restoring side would be a lot more complex--merging the full and incremental could be challenging. But maybe just use tar to restore the full backup, and then restore the incremental over it, all in a temp dir...and then do the processing to inject the configuration and stuff into the right places after all files have been updated with the incremental. I think this would work?