Hello,
I am not 100% sure how it could be implimented on the non-webmail based access, but a feature to expire a username and password and to remember the last x passwords so the user has to change their password would be a very useful feature (and would ensure that any comprimised passwords would not be comprimised for an infinte amount of time!)
This setting would be good to be included in the group configuration.
maybe an idea would be to send an email to the user x days before the password expires telling them to log into webmail and change their password.
Thanks
Ian