1. share everyone's mailboxes to an admin user who does the backup via IMAP.

2. create an app-password for each user which can be used to backup that user. This can be done as an admin user on your account.

Neither of them require knowing the user's password - an admin can override into each account unless it's specifically locked down to deny that. It does require a separate app password per account, we don't have a way to create a single password which can view each user's account without them explicitly sharing the folders, but I'm not sure how you reasonably do anything else without it being a backdoor behind all the privacy settings on each account.