Speaking of Roundcube: If you're hosting it without apache (as in: without htaccess support), make sure the logs directory and files aren't exposed publicly. They can contain access tokens and even encrypted passwords (encrypted with a default password unless manually changed during installation), and follow a known file structure, so it's quite common for people to get owned this way.