Besides those listed I think a plus would be to only have one server listening on priviliged ports (<1024), using the same/similar TLS configuration for both web and mail, etc. Basically having one service be the arbiter of your incoming traffic and its encryption.