That admins can read the emails in their managed accounts is working as intended.
School accounts aren't for privacy, period.
Be it emails, databases, file servers, anything reading content from anything else but a test account/db/folder is a no go for a sysadmin/dba unless given explicit consent by the user owning that content.
There is a big difference between being able to do something and being allowed to do something.