Securing a mail server is full time plus job. No, it's not. I say that because I am the sysadmin for two mail servers (postfix/dovecot) with hundreds of users

Securing a mail server is full time plus job. No, it's not. I say that because I am the sysadmin for two mail servers (postfix/dovecot) with hundreds of users that have been chugging along for 30 years or so with no significant security incidents -- and since I know what my full-time job entails, I can tell you that on a day-to-day basis mail requires an absolute minimum of maintenance.