Errr, I've read that's a standard tactic nowadays. You write and save drafts, and the other person logs into the account and reads them. No email servers are touched, it's supposed to be a good method ... unless of course an IP address is compromised. As mentioned, once they started looking, they correlated the IP addresses and times with her hotel stays.