Assuming the server supports SSL/TLS (i.e. it has a valid certificate), it is possible to protect the email communications between the server and the user with SSL/TLS. This is especially important for the password - without this the password will be sent in the clear. But that won't protect the email communication between your server and other servers (assuming you send emails to other people that don't use the same server you use) or between the other servers and their users.

For this you need some form of email encryption. For email encryption to work both the sender and the receivers of the email must use compatible email encryption software and must share public keys. I believe Enigmail is compliant with PGP and should be compatible with any PGP compliant software.

As you note another concern is the security of the emails at rest - i.e. on the server. This is a greater risk in that an attacker which breaches the server will have access to all emails that are on the server including historical emails. An attacker who can read the communications between a user and the server can only read current emails. For the same reason it is most critical to protect the password then the emails - an attacker with the password can read all of your emails, including your future emails. Details on how to protect an Apache server can be found [here](http://security.stackexchange.com/questions/77/apache-server-hardening).

For a great analysis and recommendations on how to secure emails, please see [the NIST Guidelines on Electronic Mail 
Security](http://csrc.nist.gov/publications/nistpubs/800-45-version2/SP800-45v2.pdf).