Email environment would also benefit to scrub since there is high vulnerability potential in email, ensuring practices are up to industry standard, ensure user quality malware education is active and accepted by users, ensure there isn't a corruption in the environment by accessing environments in same sessions, ensure users are invoking encryption, ensuring the infrastructure is secure and patched, implement beefier mail scanning if the systems are lacking, etc. These are a few off the top of my head.

Email has potential of huge compromises.