Once the form is submitted and you have confirmed that the
information entered is correct, display another form with the
username and password in hidden form fields, named appropriately to
match the webmail login form. The action of that form should also
match the action of the webmail login form. Then add something like
<body onload="document.form[0].submit()"> and you will
forward the user to the webmail app, submitting the username and
password just as if they did it normally, with the exception that
the referrer will not be correct. Hopefully the app doesn't check
for that.
You should consider putting a submit button on that page
however, just in case the user has javascript disabled otherwise
they could be left in limbo. Place the button inside a
<noscript> block so that it's only displayed to these users.
That will give you the most seemless appearance.