> As an email host, you surely have an agreement with your clients that they will keep their credentials secure and not share them with anyone

Why would they? The users can do whatever the hell they want with their credentials