I work as an information security officer in our IT department, and occasionally I have to check up on what people are doing at their workstations.
The over-riding principle here is a) the company owns the PC, b) the company owns the internet connection, and c) the company owns the mail servers.
They have every right in the world to monitor how that equipment is being used. Period.