Here is my recommendation. You only have to install and maintain patches on one piece of software other than OpenBSD. The software is OpenVPN with OpenBSD's sendmail and popa3d.
Why popa3d? User can use any mail client he choses and you don't have to worry about your email server running out of space.
