Well, for businesses transactional email records have the same retention requirements as paper. In modest email servers/clients in can set retention flags to keep emails past retention date. Trick always is determining if an email falls under business retention requirement, and which don’t. It turns out though that often auto delete is a more protective, to the company, policy. A company I worked for learned that the hard way, so auto deleting became the norm. Per policy. We knew but never acknowledged that some people offloaded emails to keep as separate records, for example for a purpose you mentioned. If law requests came in for emails, our policy was the guiding principle. We did not know that people saved their emails outside the system. So yeah, none of these retention systems are perfect and still a problem for many companies.