POP3 is actually supposed to lock a mailbox folder from concurrent POP3 sessions when being accessed. Presently we don't actually do this. I'm implementing this as part of the mailbox refactoring. This matches poorly to database transactions and j2EE transactions. What I've decided to do is implemenet a lock table which gets an entry which expires at MAX_LIFE for the connected pop user. The lock will be given up when a user disconnects spontaneously or when the user issues quit.
Eventually the table will have servername in it and we can check the thread id when connected to the local server to make sure that the user is indeed still connected, but not for M4.