It's staging data for exfiltration. This is an attempt to take property and data not owned by the employee.
They haven't disabled the "download email button" because there are legitimate reasons for employees to download data (e.g. opening files in local apps), but trying to retain access after being laid off is not one of them.