Empty files in /var/spool/postfix/maildrop/

This happens when domain.com has an MX record (or, in the absence of an MX, an A record) that points to your Postfix server, but your Postfix server is not configured to accept mail for that domain. It's commonly seen in two situations:

1. You've acquired a new domain that you want to use for email, but you just forgot to add it to Postfix. There are a couple ways to do it. In my case, I'm using the virtual table to map addresses to real local users, so I list my domains in the virtual_alias_domains directive in main.cf.
2. The domain has its MX record set to a host that resolves to 127.0.0.1. Some malware will use this trick so they can set their return address to a valid domain, which most anti-spam measures will check for. However, the MX effectively prevents any delivery to that address, so the sender doesn't have to deal with replies or bounces.

This is what I have found:

When using the standalone maildrop build with courier-authlib, one of the following configurations must be used:

• Your mail server must invoke maildrop as the root user (the -d flag reads the mail account's uid and gid, then drops root) .
• Manually change the permissions on the maildrop binary to be setuid root.
• Manually change the permissions on the courier-authlib's socket directory (/usr/local/var/spool/authdaemon by default) to be globally readable or executable.

A changed the group ownership on the /var/run/courier/authdaemon folder from "daemon" to "vmail" and everything works fine now. I have restarted the courier-authdaemon and I can still login to my IMAP account (I guess this library is also used when Courier id looking up user accounts and password).

Is there a security implication of doing this that I should be aware of?

I guess not. User vmail does not have a local account on the box, and someone in the vmail group would be able to access all the emails on the box. Protecting the passwords doesn't seem like that big of a deal if my system has already been compromised like that :)