There should be more error checking for various things, in particular
sanity checking of the form variables passed in.

Could check username/password submitted against horde's copy of the password
to make sure they match and if not reject it earlier.  Instead we are
currently waiting until the ftp connection fails to see if the password
is wrong.  This isn't very precise as the ftp connection could have
failed for other reasons.

Does this really need preferences? If not, should remove config/prefs.php
file.

It only is meant to work with one address to forward to, and may have
problems if you enter more than one address.  May need to address this in
both the form input (max length) and the forwards.php file (check for
problems?)

The exim sql driver defines a lot of stuff in conf.php that should
already be defined in Horde/IMP's configs.  We should probably reuse
the Horde/IMP stuff rather than duplicating the configuration???

Add gettext strings where missing, like in javascript form submission checks.

Investigate using ftps via the php ftp_ssl_connect() function.  Only in 
PHP 4.3 and above probably?
