For virtual domains, sometimes I'll use the internal EXIM support or, for more complex setups, MySQL.
:D. the vpopmail backend is hosted on mysql.
I don't usually have an AV running on my e-mail servers. When I do, I like Frisk's F-Prot. Spamassassin is a must, if course.
I'd prefer Command Central if it was a paying solution.
For WebMail, I still use IMP most of the time, even tho it lacks easy multidomain support. Never stoped me from having, tho :)
:)