It all depends what those accounts are being used for - if they are running services then they may need additional rights. In particular I am guessing that the crmmail one may be being used by email router, possibly as a global account to access all email inboxes rather than trying to maintain credentials for all users.
You should be able to not use a domain admin account for that, but would need an account with rights to all mailboxes (if indeed that is how you have been using this).
As a general factoid: No CRM user, even deployment admins and system administrators needs to be a domain admin. A regular user account is just fine.
A deployment admin will need rights to log on to the server where Deployment Manager has been installed, which could be through local privileges or an AD "server admins" group for example, but again should not need DA.