As nobody has yet posted a working answer and I discussed solutions with hacker yesterday in the chatterbox, here what we came up with :

1. A setuid root CGI that writes directly to the files .vacation and .forward or that executes vacation -i via sudo. This is the least desireable solution, as anything requiring root permissions is a security risk.
2. A CGI that writes the new values into temporary files (one per user) or into a database plus a cron job that runs for every user (or central as root) and which updates each users vacation file nightly from the database. This is more secure, as the only point where you need root permissions is where you overwrite other users files. Special care must still be taken when getting/processing the list of all affected users that no username is misexpanded (spaces in usernames, weird characters in usernames etc).

While neither of these is a "working" solution, at least the second one should be a solution that can be easier implemented, as you don't have to muck much with permissions and the risk of accidentially overwriting other files is greatly reduced.

perl -MHTTP::Daemon -MHTTP::Response -MLWP::Simple -e ' ;    # The  
$d = new HTTP::Daemon and fork and getprint $d->url and exit;#spider
($c = $d->accept())->get_request(); $c->send_response( new   #in the
HTTP::Response(200,$_,$_,qq(Just another Perl hacker\n))); ' #  web
[download]

Google provides lots of results including this.

I'd like to add that just because there are lots of options that can be found with a simple search doesn't mean you shouldn't have asked this question. It's great to generate discussion, maybe someone has something even better sitting on their hard drive, or has a better approach to the problem. So keep asking :)

Since I have avoided perl+setuid like the plague I cannot really comment on a perl solution for you. No doubt there is more than one! You mention that maintenance might become a problem with a greater number of users, so you may well discover that a clever script now, will give rise to some more clever scripts, followed by some desperate ones - over time. It may well be the case that rethinking the mail-server strategy will save you work, pain, stress and mileage in the long run.(YMMV)

You mention LDAP++ , I have found LDAP a fantastic way to retrieve user information, particularly with perl, much software supports LDAP authentication also. I am drifting OT now , but will recommend you check out some of the features of InsightServer (v4.0.0b which I am re-evaluating ATM) and DBMail, who specifically mention..

Security.
     Dbmail has got nothing to do with the filesystem or interaction w
+ith other programs in the Unix
     environment which need special permissions.
     Dbmail is as secure as the database it's based upon.
[download]

Those are my two cents, most of this I am still researching. Insightserver is _ALMOST_ a MSExchange killer but it does cost $$ (less than Exchange), it still makes a nice db-backed imap server, and from what I see today the v4 beta has had it's administration interface VASTLY upgraded. I discover that Vacation is part of its web admin tools.