Thank you very much, Scott.
Based on some forum comments about Gmail limitations and issues I decided to host email with DH.
I actually didn't know about the Account Privileges feature. I just assigned privs to an email address for my client's domain, logged in, and saw that DH has done a very good job in restricting access from other domains in an account.
Until something else comes along that should be adequate. I only want my client to be able to maintain email, but this is their domain and some would argue that they should have full access to maintain many other site features.
I do not like that someone can add one-click installs, that they can maintain DNS, or that they can generate API keys, and there are a lot of other features exposed that they can't use which I'd rather just keep out of their sight, but again, it does look like any damage that can be done is restricted to their domain.
The only question I would have is that for a user with X permissions, whether an API key generated by that user would restrict them to those permissions - or is that an unprotected access point?