Could it be that you removed some plugin added by the dlls and now it crashes sincethe AssemblyName and TypeName in the db no longer matches any implementation? That would perhaps not result in a null pointer though. A guess is that it is the remaining tab that is the culprit in some way.

Try having a look at what EPiServer does in its EPiMail installation powershell scripts. In the installation directory (or extract the msi file with Microsoft Orca or Lessmsi) I believe I've seen an SQL-file for Mail adding tables and what-not. You will also find a directory with configuration changes that the mail installation does there. This won't give you what the EPiMail dlls might add to the database in regards to GuiPlugIns etc, but it's a start.

Another but rather cumbersome way would be to set up a site without Mail, back up the filestructure, and then install Mail and initialize the site while at the same time running a trace on the database (SQL Server Profiler) to see what is done in there; and then doing a simple folder/file diff on the files.

Maybe not a simple answer but it's a way forward.