see below commit. Attempting to inject on dovecot-1.2.15 (incidental a debian squeeze machine) refused to log rhost=1.2.3.44 as a username. I haven't seen other injectable strings in the mail.log for dovecot (no reverse DNS for instance).