By default, all IMAP messages are stored on the server. The message list is synced to the client so that the client can be used when there is no Internet connection.
If you want to save messages on the server, then you want to use IMAP. That's what it's designed for.
POP3 is designed to download messages to the client, so that they are only available on the client. The "save a copy on the server" feature is an add-on hack that should not be relied upon (all it takes is one client with this turned off to delete all messages from the server).
As for users who delete messages they shouldn't, that's why there's a Trash folder.

And backups.