That's sounds pretty easy to solve redacting the sensitive content when it hits your mail server before going to support staff. If you're sending out HTML email you can also make easy and extensible by having a custom class for redactable contents.

Realistically customers are going to fwd those emails anyway so this approach is more robust.

It seems like most information in these emails would be available to support staff typically though. It sounds like a niche case.