With the current mailinabox setup, I think the only two options are what Josh laid out.
Option 1) Create a@ as the alias and a1@ for the login. Then in Thunderbird or RoundCube you could have user a1@ send as a@. In roundcube it is in settings>>identities.
Option 2) Use the RoundCube filters to forward email, but that doesnt resolve your issue of the end user not having access.
I would think option 1 would accomplish what you want.