I'm curious about this too, and whether 'off the record' does anything with a corporate account.

With Google Apps for Domains you can take over an email address, for example after you fire someone. Nothing prevents you from seeing old emails.