Disabling email forwarding in webmail for security reasons

Hello we have noticed that when a customer clicks on a malware email, one type of malware installs in their computers and then send email/pass credentials to hacker, then at any given time hacker will send out spam with the credentials We have noticed that when they steal email/pass they also log into webmail and do 2 things: 1) they create email forwarders to spy on incoming email (sent out to a weird gmail address) 2) they create filters inside webmail to accomplish this same spying. We have to continually enter WHM and check for this type of vulberabilities in users accounts. My question is: Can email forwarding and email filtering be disabled from webmail? call it roundcube or horde. but NOT in cpanel? We disabled it in whm but it will completeley shut down the option to forward email also in Cpanel. Some customers need to have emailforwarding in Cpanel. Hope this is clear :) THANKYOU