Adding users 'should' be a root/mailadmin action, so I guess you should make a queue list of user that should be added,
and then use the cron to run a script under the root user to actually add the users.
I would definately not give PHP/your webserver permission to do it. Hackers are everywhere, and a good DOS might wreck your service completely.