Hi there,
This is because the employee has permissions to access the emails, you need to check permissions on the security role.
for more information on design and how CRM security works have a look at this article:
quantusdynamics.blogspot.co.uk/.../dynamics-crm-data-driven-security.html
Hope this helps