Sorry, I think you'll need to walk me through this step-by-step. 1. User enters their IMAP credentials into desktop web app. 2. Web app transmits credentials

Sorry, I think you'll need to walk me through this step-by-step. 1. User enters their IMAP credentials into desktop web app. 2. Web app transmits credentials to the backend where it is used to sync e-mails between Azure and third-party IMAP server. 3. Somehow the credentials leak to some untrusted third party. 4. User is murdered. This feels like some rather important steps were skipped. If your threat scenarios include "being murdered because someone got access to my e-mail account", yeah, maybe just use Thunderbird to begin with.