Many sources claim this is a problem in pam modules. Dovecot wiki http://wiki2.dovecot.org/PasswordDatabase/PAM says they have a pam_maxrequests for this.
I use postfix and courier and wanted to try...