There are other ways to handle even these extreme fear-mongering examples that don’t require Admins snooping through their users private and personal information, especially when it’s Personal Health Information.
A few ideas:
- Disable attachments in messages
- Disable external links or flag excessive links
- Flags for suspect messages
Whenever I discuss this with my infosec & privacy colleagues, they’re always extremely suspect of why any admin would fight so hard to be able to snoop around like this. There’s a reason why the “minimum access necessary” theory is a thing.