VirtualMin supports running a local MTA and the client-side of DMARC. Maybe a wishlist item to also start supporting the server-side and start responding to RUA and RUF instructions?
It would require quite a bit of work: collecting the data, scheduling a cron to (daily) send out the mail in the required formats, adding config to enable and configure it.
The Abuse Reporting Format (ARF) as per RFC6591 should support Authentication Failure Reporting Format (AFRF) and Incident Object Description (IODEF).