Bummer. Sorry, Falko. Only paid attention to the thread title, not the forum.
Don't like to open new threads about topics already started by someone else.
Anyway, I have managed to solve the issue by adding the postfix user to MySQL with the privileges the default admin_mail user enjoys. This step is not mentioned in the howto I have used as a reference.
Now it does work
GRANT SELECT, INSERT, UPDATE, DELETE ON mail.* TO 'postfix'@'localhost' IDENTIFIED BY '<password>';
GRANT SELECT, INSERT, UPDATE, DELETE ON mail.* TO 'postfix'@'localhost.localdomain' IDENTIFIED BY '<password>';
Now it's time for some serious real world testing.
The fact that the domU is NAT'ed may raise some interesting challenges (or not; so far iptables masquerade is routing it all just fine). If so, I'll be a good boy and open a new thread
Cheers and huge thanks for your impressive work.