...
Our changes (off the top of my head since I'm at home):
- IMAP configuration tuning (allow setting of pretty much all javamail options on a per-server basis)
- IMAP protocol connection handling work - minimize chatter, # of communications, optimize performance - we saw signifcant gains in our environment
- Authenticated SMTP, IMAP SSL & SMTP SSL support
- Preferences refactoring to use a key-value pair table in the DB to allow arbitrary preference values (instead of UBCWEBMAIL_PREFS, SERVER_CONFIG, etc. - just webmail, not yet addressbook) fronted with a portlet-api subset interface (implemented PortletPreferences API for most single-valued methods)
- Performance in general - we've spent ~ a year tuning IMAP performance. Empirical and user reports say we're now the fastest webmail at campus (there are separate IMP & Squirrelmail instances)
And some bits which overlap your list below.
...
We're fighting this since we don't have the support resources to dedicate to responding to phishing concerns. We're trying to keep portal mail service text only, and pushing users who really want Rich Text to use a fat client. We may have to give eventually though. We're considering
- url "linkifying" (finding urls and making them links)
- image attachment display (e.g. display attachments that are images inline)