the problem is mixed up session ids. i have made a quick patch based on the upstream update. i've attached it. it is for the c4 version, but probably would apply to c5. apply it with:
cd /usr/share/squirrelmail patch -p3 < FILE
also, after this sometimes customers will have to clear the SQMSESSID cookie from their browser or they won't be able to login.