When you let someone else handle your email, they own your email. There is no postal secrecy law, no rule against reading. They can touch, modify or delete according to their whims. It's their email now. So I am not that very surprised to hear a news article like this. It makes perfectly sense with the current mentality. It also adds another nail in the coffin about idea that "only a machine is reading my emails. Why…
I actually tried many times to setup a mail server on my debian machine but never could find a good tutorial. I gave up because I lack the time. edit: I just tried again, for more than a couple of hours. First I had to guess that I had to install MDB2_Driver_mysql. Set up a DNS to match my /var/lib/roundcube and now I'm struggling to understand how I could sign-in since he didn't create any user for me.
As for users, roundcube uses imap and thus do not create new users.
Anyway, GL, and if you want to have some fun, try out PostgreSQL.