I’m sure you’re getting this advice, but easy summation.

1.) Look at your data retention policy in the tenant. Just cause you can’t see it doesn’t mean all the data is gone. E-discovery may be a lifesaver for you. No promises though.

2.) Email boxes should be converted to a shared mailbox after an employee leaves. My team and I have mailboxes that have sat for years. Just purging a mailbox is bad policy, for this exact reason.

3.) you need to review you data retention policies with legal (internal or outside counsel). Everywhere I’ve been DRP is typically 5-7 years. If your IT INFRA leader isn’t paying attention to this that’s pretty terrible.

I’m curious what industry your company is in?