All companies with a network and an email server need to keep user account info on file. If you aren't then you are not protecting your network. I don't know how many people I have seen actually open a virus infected email after they had been warned about it. I need to know who the risk people are and be able to see there inbox. So if I can do it so can the boss. Plus, when people get layed off or leave their email is still on the server and I continue to back it up in case it is ever needed for legal purposes.