Thank you for the speedy response!

...

The dovecot-auth process' VmRSS size grows by 4k per request and has a limit of 256megs.

The main dovecot-auth or dovecot-auth -w processes'?

dovecot-auth -w is the culprit.

...

Okay the question: In dovecot 1.1.0 beta3 I see that blocking=yes is now on, no matter what. Has something been done to address potential memory leaks in pam modules?

# Number of auth requests to handle before destroying the process.
This may # be useful if PAM plugins leak memory. #auth_worker_max_request_count = 0

This looks promising, thanks!