Comment by magicalhippo

I was tired and forgot to add they should first check if the IMAP server supports XOAUTH2, and in that case require that to be used.

Still not a great solution but at least not passing the password around.