We setup our own install of roundcube. That way, we don’t have password reset capabilities in the webmail, and we could also add an addon to enforce verification of email addresses for personas.
In a default Roundcube install, anyone can add any email address to send as, without having to verify that you have access to the address.
It also let’s us continually update the client. And provide a login form directly on our site.