Outside of administrators, drafts may also be accessible if your boss was given access to relevant search terms as part of Google Vault, G Suite's e-discovery functionality. Or if an OAuth service account was created and given domain-wide IMAP delegation, and the data pulled from it is made available to others. All this is extremely powerful and by design.

https://support.google.com/a/answer/2462365?hl=en

https://developers.google.com/gmail/imap/xoauth2-protocol#do...