Honestly, assume that everything on a work computer is being tracked - if the IT dude had managed to crack this fellow's personal email password then that's a different matter altogether.