Which user forwards internal company emails to his private address
Which user forward email to external addresses
Unless there is a rule that prevents the user from being able to forward e-mails to an external address, checks should be carried out at regular intervals. Happy also automated.
And this is how it could be: