Follow up:
cmouse from #dovecot pointed out, that this was a dovecot bug which is already fixed in newer dovecot versions. Thank you!
With dovecot 2.2.34 (current debian backports version), I can not reproduce the error.
So my last, "bug unrelated" question remains:
4.) Is there a tool, with which you can export and import mail to the same inbox?
Background: After activation for an existing mail user, only new outgoing and incoming mail is encrypted. So it would be necessary to "re-save" the existing mail again in this mailbox, to pipe all mails through the encryption process.
I know that there is dsync, imapsync and several different tools, but I'm not sure what is the best tool for the job, or if I should use dsync to do a 3 way sync?
existing_mailbox@server.com > tmp_mailbox@server.com > existing_mailbox@server.com
Thanks again to cmouse.
cheers neutron