Email account password change via email-to-script

I host a mail server (postfix and dovecot) and I wish to set up a password change feature (especially useful when creating a new address provided with a temporary password).

Does my scenario has security vulnerabilities?

usage:

from their email address, user send an email with the subject "password" and containing in the body the new password in clear to a special address that run a script.

This script read the new password in the mail content and change the user's password.

context:

• Only the addresses of the domains managed by the mail server can send an email to this special address


• SMTP and IMAP connection using TLS only


• Mail are delivered locally to the domain and do not pass through an intermediate SMTP


• After the change password, the script delete the sent email in the mail sent folder of the user account

EDIT:

• the SMTP server accept only authenticated user


• my script check the value of sasl_username provided by postfix