I think sending it to external accounts probably triggered this, there is no way this would not have raised a red flag in any company. I mean, Alphabet is the same company where a person took self driving documents with him to start a new company.

Hopefully, if it was just normal conversations and after identities had been redacted, their access is restored. Still, analysing this information on their work machine itself and then sending out a summary seems like a better course of action than this.