Yes. This. One thing you learn the good way or the hard way when you start to run companies is that any email should be considered part of a public audit trail

Yes. This. One thing you learn the good way or the hard way when you start to run companies is that any email should be considered part of a public audit trail, regardless of whatever unenforceable boiler-plate .sig text the legal beagles insist is appended. It can all end up in the public record as part of court evidence, or from man-in-the-middle capture, or Snowden-style whistle-blowing...or invent your own scenario. In this case, the auditor was asking the poster to do something rather illegal, and certainly extremely unwise, to the point of compromising both the poster's career and his employer's business. Given those points, I'd say that publishing the emails constitutes fair self-defence, and the auditor - to put it bluntly - is very lucky that the poster was too professional to name and shame both himself and his company.