In reality, I think the only way to do this is just not to let the email leave the bounds of their own servers for x seconds, and then only if the user hasn't canceled in the meantime. Maybe it's possible to do if you host the email for both sender and receiver, but even then, it seems unlikely given the implications of being able to see an email literally disappear from your inbox.