Re: I'd be surprised if anyone *hadn't* hit this...
"I've had a user store important emails that he needed to keep (some for regulatory purposes) in his Deleted Items in Outlook."
I'd be surprised if a regulatory audit would accept that as meeting the requirement.