> Can this scale to 10's of 1000's of users on a big server?

No, probably not.

Indeed disk space may become an issue (though you can get large disks nowadays; also, if you want to be that big, modifying the code to storage the raw emails (or only the large ones) externally should be worth the time). And if you are that big, you probably want a backup mx, which pretty much requires replicating the index database to another place, which isn't supported yet.

But more importantly, mox doesn't have a spam filter or rate limiter for submitted (outbound) email. So it will currently take 1 compromised account to damage your IP's reputation. It's on my todo list.

I heard dovecot has an option to store messages to s3. It seems to be part of a paid variant.