The way it would be setup is that dovecot encrypts the stored mail with a public/private key system.

On user creation a command (doveadm) has to be given to dovecot to create the keypair and lock/encrypt the private key using the users (cleartext) password.

This way incoming mail is encrypted using the public key from the user.

Then if a user logs in using IMAP or POP3 dovecot passes the cleartext password to the encryption plugin which unlocks/decrypts the private key and proceeds to make the mail readable, as well as decrypting fts userstore.

If the users password is modified doveadm needs to be run again, this time both the old and new password are required to be successful in reencrypting the privatekey using the new password (unlock private key using old password -> private key -> lock again using new password).

Obviously if user forgets their password all their mail is lost, there is no way to recover without exploiting weaknesses in algorithm (that don't exist as far was we know) or bruteforcing,

So for this to work I would need to have a way to pass the plaintext passwords to a shelll script.

-edit- if such facilities exist and are reasonably accessible I'll write some scripts and a guide after testing and validating the setup