It depends on the setup. There are different nuances but through an Admin granted API key you could potentially access all emails. There are safeguards that companies put in place to restrict this as well.