If it’s a legit enterprise mail server, then a mail trace or logs can reveal what the emails contained. A simple email with “synchronization complete” as the only contents isn’t necessarily a fire but it’s definitely smoke. I’d check for any software or services on file shares or databases. Why is her email still sending emails after her separation from the company?