My particular use case is a bit unusual. An applicant entered their system password in the “Institution” field as part of their registration process. I sent a follow‑up email back, prepared using emacs macros, that included their institution details in the “To:” line of that email. In plain text. Oops! As a result, the applicant asked me to immediately delete their entire application. (I think the applicant uses one password in multiple contexts, not good practice of course.)
So the feature I seek would only apply to rejected applications and would be undertaken manually at the full discretion of an administrator.