How to Remove a Departed Employee's Mailbox and Keep Their Mail

When someone leaves, their mailbox holds customer threads, supplier agreements and the last message they sent to a client the day before. Deleting it on their final afternoon is the most common and most expensive offboarding mistake. The right order is suspend, capture, redirect, and only then delete. Here is that sequence with a realistic timeline.

Quick summary

• Change the mailbox password or suspend the mailbox in your host's dashboard so the person can no longer sign in. OquMail lets the admin suspend a mailbox in one click, which blocks login while keeping every message intact.
• Sign out any sessions if the host offers it, and remove the account from company devices they are returning.
• Check whether the address is used as a login for company tools (accounting, CRM, domain registrar, social media). Change those logins to a role address such as admin@ before the mailbox goes away, or you lose password resets for those tools.
• Turn off any forwarding rules they set up to personal addresses.
• Export the mailbox. Connect it to Thunderbird or Outlook with IMAP (mail.oqumail.com, port 993), wait for a full download, then export as mbox (Thunderbird with ImportExportTools NG) or .pst (Outlook, File, Open and Export). Store the file with your business records.

Day of departure: suspend, do not delete

1. Change the mailbox password or suspend the mailbox in your host's dashboard so the person can no longer sign in. OquMail lets the admin suspend a mailbox in one click, which blocks login while keeping every message intact.
2. Sign out any sessions if the host offers it, and remove the account from company devices they are returning.
3. Check whether the address is used as a login for company tools (accounting, CRM, domain registrar, social media). Change those logins to a role address such as admin@ before the mailbox goes away, or you lose password resets for those tools.
4. Turn off any forwarding rules they set up to personal addresses.

First week: capture what the business needs

1. Export the mailbox. Connect it to Thunderbird or Outlook with IMAP (mail.oqumail.com, port 993), wait for a full download, then export as mbox (Thunderbird with ImportExportTools NG) or .pst (Outlook, File, Open and Export). Store the file with your business records.
2. Alternatively, or additionally, move the important folders into a colleague's mailbox by dragging them between accounts in the same mail app. IMAP-to-IMAP moves keep dates and attachments.
3. Have the manager skim Inbox and Sent for open customer threads and reply from the successor's address, introducing themselves.

Weeks 2 to 12: redirect the address

• Keep the address alive so customers who write to it get a response. Either add it as an alias on the successor's mailbox, or set a server-side rule on the suspended mailbox that redirects to the successor and sends a short auto-reply: "Ana has left Yourcompany. Your message has been passed to Ben (ben@yourcompany.com)."
• Do not announce more than necessary in the auto-reply; "has left" is enough.
• Update the website, signature blocks and any directories that listed the old address.

After 90 days: delete or archive permanently

By three months, anyone who mattered has the new contact. Delete the mailbox from the dashboard, keeping your exported copy for as long as your retention rules require (often five to seven years for anything financial). If the address was widely published, keep it as an alias on the successor indefinitely; there is no cost to doing so, and it keeps customer mail flowing to whoever owns that relationship now.

Reassign role addresses and logins

Separately from the personal mailbox, list every role address and shared mailbox the person had on their devices (support@, sales@, billing@) and remove their access by changing those passwords, since a shared password they still know is a back door. Then check the domain registrar, the mail host dashboard and any payment tools for admin rights in their name and transfer those to a current staff member the same day.

Privacy and legal points

• Tell staff in writing, ideally in the contract or handbook, that company mailboxes are company records and may be accessed after departure. Reading a former employee's mail without such notice can breach privacy rules in some countries.
• Remove genuinely personal messages if the employee asks and it is reasonable; keep business correspondence.
• Under GDPR and similar laws, a departed employee's personal data in your systems should not be kept longer than needed; business records are a lawful reason to retain the mailbox export.

Common questions

Can I just forward their mail to my own inbox forever?

You can, but you will stop reading it within a month and it will not free the mailbox slot. Redirect for a defined period, then convert the address to an alias on whoever owns that relationship now.

What about their email in other people's mailboxes?

Nothing changes. Messages they sent remain in every recipient's mailbox. The export is only about the copy that lived in their account.

Should I reuse the address for a new hire with the same name?

Avoid it for at least a year. The new person would receive mail intended for the old one, including possibly personal messages, and clients would assume continuity that does not exist.