Mail account for: is not enabled

After migrating over from 10.5, my Open Directory users are unable to access email. All other services are working. The recurring pattern is "mail account for: <shortname> is not enabled". Any ideas, even crazy ones?

[Mail Access log]

auth(default): od(pseudonym,127.0.0.1): auth mech=CRAM-MD5
auth(default): od(pseudonym,127.0.0.1): username=pseudonym, challenge=<4456573209122538.1253635938@server.example.org>, response=df109a3ef93c61c1e2b7fc4fb1f67fa4
auth(default): od(pseudonym,127.0.0.1): mail SACL is enabled; overriding settings in user record
auth(default): od(pseudonym,127.0.0.1): found user in local table: user=pseudonym
auth(default): od(pseudonym,127.0.0.1): mail account for: pseudonym is not enabled
auth(default): client out: FAIL 113 user=pseudonym
imap-login: Aborted login (auth failed, 1 attempts): user=<pseudonym>, method=CRAM-MD5, rip=127.0.0.1, lip=127.0.0.1, secured

[User Record from Workgroup Manager]

<?xml version="1.0" encoding="UTF-8"?>
<dict>
<key>kAPOPRequired</key>
<string>APOPNotRequired</string>
<key>kAltMailStoreLoc</key>
<string></string>
<key>kAttributeVersion</key>
<string>Apple Mail 1.0</string>
<key>kAutoForwardValue</key>
<string></string>
<key>kIMAPLoginState</key>
<string>IMAPAllowed</string>
<key>kMailAccountLocation</key>
<string>server.example.org</string>
<key>kMailAccountState</key>
<string>Enabled</string>
<key>kPOP3LoginState</key>
<string>POP3Allowed</string>
<key>kUserDiskQuota</key>
<string>0</string>
</dict>

I've already had to update the dovecot.conf once <http://support.apple.com/kb/HT3792>, but I can't tell if this is on the Dovecot side or the OD side.