Why not hash/encrypt it before storing it in the dictionary if you are concerned about security... I might be tempted not to store in the dictionary at all though as that is designed to be a front end facing repository...

Are you wanting to be able to have multiple smtp servers for sending of different emails across a single umbraco site? If not then storing the smtp info in the web.config should be safe? (if you go this route then you don't even have to worry about coding smtp locations etc in your mail obj... mail.send() will just use these as the default settings...

[you can also combine witht the umbracosettings.config to use the default notification system settings

<notifications>

      <!-- the email that should be used as from mail when umbraco sends a notification -->

      <email>XXX</email>

      <displayname>XXX</displayname>

    </notifications>

I've extended that to include the display name... default umbraco installation would only have the email address

so code behind something like

mailobj.fromaddress = new MailAddress(umbraco.UmbracoSettings.NotificationEmailSender, umbraco.UmbracoSettings.GetKey("/settings/content/notifications/displayname"));