Access controls are actually fairly locked down. I would guess the access control list for Gmail data is only ~10 people. If any of them were to make use of their access permissions, it would automatically trigger a review of their actions.