Hi,
I have activated only imaps and managesieve.
As sieve is running on a different port/protocol: Can I make sure that 
sieve can ONLY be used with SSL/TLS?
As the credentials are transmitted I only offer services with SSL 
(IMAPS, SMTP over SSL, ...). For sieve I am not sure about this.
If there is the possibility that user's credentials are transmitted in 
plain text I would block the port from the firewall, else I would offer 
my users the feature to change their rules with their own client (e.g. 
Thunderbird sieve).
Regards, Luke