Yeah, that sort of thing - by giving permission on a per email basis, they are then allowed to look at that particular email to see how/why the model is miss classifying it, AFAIK

(That's different than just marking an email as spam, though)