You mentioned in an email:
"We are, however, currently in the midst of upgrading all of our platforms to Dovecot 1.0, which will allow us to finally lock down directories of domain users to 750 permissions. When combined with suexec for all script types, this is pretty solid shell security."
I'm really excited about that - do you have an ETA? I don't want to use VirtualMin for shared hosting clients until thats implemented, as security is a big issue :). Do you think that'll be in VirtualMin by December 15th?