yep, that is possible and i've done it for a couple of customers (pop3 only, which isn't a hard restriction)

and yes, it requires writing to the DB also adding a security mechanism to prevent spammers from going crazy..