Someone pasted in a bunch of confidential info into an email that was for discussion, with a few replies back and forth. After a hallway discussion with another colleague, I sat down to forward the latest email to him, but Outlook autocompleted the email address to an external vendor. Before I knew it, the email was away. I quickly sent the vendor rep asking him to delete the email I just sent, and he agreed. I assume he was professional about it.
What can be done? Confidential discussions via email is a must. Trying to get the entire company into a secure web/app-based platform only is a non-starter. You can't take away the ability to send email out. A custom "Internal Distribution Only" flag in Exchange might work, but I can already hear the complaints already of having to set/unset it with every email.