I guess they could just create bogus entries that show as emails for IMAP/POP users.

What about disabling IMAP access and forcing users to use the Gmail webapp?

Or on my phone