Also of concern, are you even aware which emails / other people have be uploaded to their systems?
As far as insider info, most larger companies I've been at use a variety of confidentiality levels for their data, the highest of which cannot be emailed or put in the cloud. I believe that most corporate governance professionals are well aware of the risks and options for how to work with such things. But to be fair, your average office worker is not, so compliance with such policies becomes a cultural and education concern.
But that's usually done to add "state" to emails so they can be tied to one thread in the support system and people can reply to either the email chain or via some web interface. I don't think you necessarily want to interfere with that.
I have more experience with the sales product than the support ones, where typically more sensitive information can be discussed.
If someone can point me to a Salesforce or HubSpot newsletter, I can susbcribe, get some samples, and then investigate.
Re: BCC ... Uh, that's a totally different topic/mechanism and I have no comment on it.
Same with salesforce: https://www.salesforce.com/form/other/role-based-newsletter/
Have you considered what Salesforce, HubSpot, and the like have? They use the BCC to record entire email chains and users...