Most people access email through their phone.

Giving up your phone also means they get a complete copy of your email.

If you use a VPN to access company servers they will swoop up that information as well, and by extension all server side data your VPN credentials Grant access.

They may not be doing all that, but it's only a matter of time and knowledge given their lack of constraints.