Two LDAP entries with the same attributes, but not the same attribute values, are recognized as the same user type.
The case in point is a regular user (with, for example, nsroledn: cn=imap-user,%(base_dn)s) an 'admin-user' (with, for example, nsroledn: [ cn=admin-user,%(base_dn)s, cn=kolab-user,%(base_dn)s ]) which are both typed as the regular user.
Adding a field attribute definition for the nsroledn to be of a format cn=admin-user,%(base_dn)s should allow the admin user to be recognized as such.