You can view full email content in the investigation tool, use the APIs to download their mail via MBOX and read it there, or if you're feeling bold, just add yourself as a delegate to their inbox.
Or change their password and remove the mfa token. The instructions for how to do so are in my administration toolkit for account recovery - and they are just as valid for hijack.
Probably our edition doesn't include the Security Investigation Tool, I'll have to check if the APIs are available anyway.