Good point I'm pretty sure some of the students here can email outside of the the school but maybe I'm wrong.
I keep meaning to speak to our Network Manager to get limits on the amount they can send to as the spam is getting ridiculous now so will check that at the same time.
The only other thing that would concern me is webmail access. Once you know someone's names their passwords tend to be either left as a default, the word 'password' or their favourite football teams. That's probably more of a job for password complexity settings though I suppose.