There are two ways to run the extension that I know of.
o Start a separate instance of Apache on its own port or IP address, running as the mail user. This instance should only serve mail related pages. This is very easy to do.
o Don't allow any web sites on the mail server. Only run QmailAdmin and sqWebmail on the mail server, and don't allow anyone but mail system administrators to login on the machine. (This is the one I use.)
Didn't you ever heard about "sudo"?
Using sudo you may allow the apache's user to run commands (that you specify) as the vpopmail's user. I did it once, it isn't hard. I also believe that's more secure, since the vpopmail's user will be used only weh necessary (to run some commands) and not all the time (to run apache).
Regards,
Eduardo M. Bragatto.