Followup question: does the sharding happen within the app that talks to the DB, or do you shard traffic before it hits them? In the former case the total number of DB connections required presumably grows something like n^2.
My team has written an integration with Google's API[0] to explicitly pull back the full bodies of emails for all users across a whole organisation, to run some analysis on all emails.
Once our service account has been granted access, we can assume the role of any user and access anything we have permission for. So, you should assume your IT administrator can also access all your emails, since they're likely to be the person that grants permission to the service account.