Certainly they can. I work in Compliance from the brokerage industry and we are Required by the SEC and NASD to review registered employees emails on a regular basis and to be able to produce all emails for a period of 5 years.