Can they monitor for such a thing? Does say, Azure AD show whenever someone downloads data? Does Outlook make a similar call to figure out the name dropdowns?
Is be surprised if any competently run large org allows that anyway. Just takes one rogue dude trying to make a quick buck by selling the info to spammers and you’re dealing with that for the next decade