I added "mail_extra_groups" setting which can be used to give imap/pop3 process access to additional groups. So what this means is if you set it to "mail" you can finally remove o-w access from /var/mail directory.

Leaving the sticky bit could still be a good idea, so there's no way users to be able to delete each others inboxes.

Here's a patch against 0.99.10.5:

http://dovecot.org/patches/mail-extra-groups.diff