Can you limit Email Clients by Ip Addresss ( dovecot imap settings?)
if people spam our emails with user and pass to connect and spam from outside of our app?
This is an easy task for Fail2Ban. Plesk comes with a jail named "Dovecot". Simply activate that jail. It'll monitor the mail log for failed login attempts and ban the IP addresses of the users who send n false logins.