[pilif]

In this case, this isn't necessarily needed as own-mailbox could be the MX and then transmit the data using some other protocol or even just SMTP over a different port.

Of course this means that they could read your email again, so we'd be back to square one.

[icebraining]

Well, they could only read the HTTPS link. If they were to open it, you'd have at least a record of that.