The HaveUser state gets the password. But the HaveUser state needs the user name to verify password, and the PASS command from the client does not contain user name. Similarly, the Process state needs the user name to get mail messages. Each client request can result in creating a new state object. If a large number of clients connect to a concurrent server at the same time, the creation of all the state objects can become a performance issue.
Solution is to create one object per state class and reuse it.
Solution is to not allow the state classes to have any data fields. One solution is to create a class to store the data needed by all states, and pass an instance of it as one of the arguments to the state methods. Call this class SPopData.