EDIT: Folks email is not secure. Even if someone doesn't have access to login to your mail account. Emails in transit are insecure.
Using outside systems to send confidential data is common practice and has been for years.
And if you want to take matters into your own hands, you use PGP. But outside of the computer security business I guess that's mostly unused.
But the pledge was just a formality - should there be any interest to check the mail, there was nothing technically stopping anyone with the required access except for someone else with equal access having a problem with it. Likewise, various management offices had no issue with submitting email fetch requests for the simplest of things, with date ranges exceeding two or three years sometimes for what turned out to be incredibly minor reasons.
There really is no expectation of privacy with academia in the US when it comes to University owned property or services.
(The only reason I found out about any of this from legal was because I asked for clarification on our "duty to report", and one of the lawyers was almost excited as he told me about how we own everything legally.)
At my company we trust our people and have a web of review. However, we try never to have anyone be the final trusted party - even the boss.
There's nothing _private_ about the paper, since the author intends to publish it, or about the reviews, since they're going to the author anyway. Only the identity of the reviewers is confidential, and for that email is perfectly sufficient. Well, a standard email client would be far too error-prone; you'd want something like a blind mailing list just so the editor doesn't click the wrong button and accidentally unmask the reviewer.