A centralized messaging system that should impart as little information as possible to any third parties, including the server administrator. Any information accessible by the server administrator is considered public as far as user security is concerned.
The server should be practical and attempt to disencourage unwanted behaviour like spamming. It should also have access control to allow private servers, but not at the cost of revealing message senders.