Opensource Webmail

I had a couple moderately sized installations running on Slackware.   I can't think of any Slackware specific caveats, I compiled everything from source, and it pretty much just worked.

Both used Sendmail and Dovecot.  I highly recommend Dovecot configured for Maildir, rather than mbox.  You'll appreciate the speed difference.  There are other good reasons for going to it, but you can search "Maildir vs mbox" on Google and find more info on that.  Watch your procmail config, you will have to set the global config to deliver to their Maildir.  man procmailrc or Google for procmailrc MAILDIR.

For the webmail, I've used both SquirrelMail and RoundCube.  
SquirrelMail has a lot of functionality, and lots of addons to make it do virtually anything.  

RoundCube is pretty.  It's light.  

The last install, I told the users, "Use RoundCube if you want pretty.  Use SquirrelMail if you want good."  
Unfortunately, I put two links up for them to use, and RoundCube was first.  It took about a month for them to start complaining about functionality, so I told them, "so, use SquirrelMail."  They had poor communication bringing problems up the line, so I didn't know the problem existed, even though I kept asking.

We tried out quite a few others, but they either wouldn't work, didn't work well, or the users just plain hated them.  I was of the opinion of, I don't care.  I'll install anything they want, if it will work, and doesn't have any glaring security holes.

Security, as someone else mentioned, is really up to the application, regardless of the language.  If the code has something intelligent like 'system ("/bin/ls $dir");' without validating the input, they're just asking me to request the directory "/ ; rm -rf /"

I strongly recommend telling your users to use IMAP for their own clients.  If you can, leave POP3 disabled. :)   If you back your machine up regularly, it will save you headaches when they complain "my laptop crashed, I need my email!", and they were deleting mail from the server automatically.

Enable IMAPS and POP3S also, if you can.  Outlook throws an ugly error if you're using a self-signed cert, and people complain about hitting "OK".  They should be used to it, they're using Windows.

The last place I was at, they were using Zimbra on RedHat.  It was a nice fast machine, but Zimbra is Java based, and it was running pathetically slow.  Like, with only a dozen or so users on, it would take 10 to 15 minutes to retrieve a single email.  Somehow the old tech told them that it was acceptable.