You should release an app that people can self-host which provides a layer of indirection for IMAP. That is, an IMAP client/server I can run myself. I put my credentials in the client part, and give you an account in the server part. That way I don't need to give you my real credentials password.

Of course, this would limit the reliability of your service to the reliability of my connection, but that's a trade-off I'd be willing to make.