There's backups. There's always backups. I can not remember the last time a company came back and told a Judge that they did not have a copy of someone's email.
If there are no backups they're probably violating a few federal laws.
I think the problem is that while they do have backups, they have no way to recover email that arrived after the last backup (since it was not backed up nor written to an audit file).
Another possibility is that the backups are physical not logical backs (ie: Here is a image of the tracks on the volume not the contents of the files on the volume organized by file). This means that if they deleted the email mailbox for userX there is no way to extract UserX's email from the backup without affecting all the other users. This latter claim is Bovine Excrement since you just do a full restore to a blank volume and copy the affected user's Mailboxes back to the live volume.
