1. My ISP provides me internet access, but they are not entitled to collect my bank information when I access my bank account.
2. Depending on the nature of the corporation, it may not be legal for an individual to forward emails in the manner described. Consider: what if the email account belonged to a lawyer or doctor? Client confidentiality probably trumps many other legal concerns here.
3. Is said manager part of the IT/InfoSec department within this organization? If not, they may be circumventing organizational controls, which in itself may not be legal.
Context is important.
Under European data protection laws, for example, many countries have considered the privacy restrictions to extend to employee e-mail addresses.
This includes Norway, for example, where employees have extensive rights to prevent employers from accessing their corporate e-mail accounts without substantial safeguards to prevent them from accessing personal information, and including rights to be notified where possible, be present, be able to respond and challenge the access etc.
You can find a lengthy (in Norwegian, though Google translate ought to do a decent job) walkthrough of the rules here [1].
Not everywhere treats people as serfs at work.
[1] https://www.datatilsynet.no/personvern-pa-ulike-omrader/pers...