We protect /mail/box 777.  It is a hole, i.e., someone can remove your
mail directory should it ever be empty, though that's not ever supposed to be
the case.  Also, they can rename your mail box though they can't remove it and
replace it with a new one.  I should think of something better.