What about using PGP or something? They could require as a matter of corporate policy that internal e-mails be sent using PGP, and that storage be encrypted. More sensitive stuff they could use OTR for.

I suppose it's not a good look if you're looking at an archived conversation and they switch over to PGP, but it's better than this.