[purple-dragon]

In addition to Vault, an administrator can easily set up an SMTP route through the admin interface to copy-and-forward all inbound or outbound mail (delivering copies wherever they please). Of course, this would only catch messages sent or received after setting up the route.

Edit: an administrator can also create an API token with org-wide credentials, allowing her to read, write, and delete messages from any user's inbox.