There is certainly an ethical challenge in balancing privacy and data protection issues when there is more than one subject involved, as in this case with both

There is certainly an ethical challenge in balancing privacy and data protection issues when there is more than one subject involved, as in this case with both the PhD graduate and those other parties whose emails referred to them. It seems a terrible precedent if any communications service may in general be required to disclose the otherwise private communications of its users if they happen to mention any individual by name (or, presumably, any other identifying features, since this is the GDPR). On the other hand, for matters of professional/business correspondence that relate to a specific individual, where the information being stored or shared around may be incorrect or misleading and the individual is being personally harmed as a result, isn't that exactly the sort of problem that data protection laws (and the anti-blacklisting laws, and defamation laws more generally, for that matter) are trying to fix? It doesn't make any practical difference whether the questionable personal data happens to be stored in something structured like a formal employee record or in unstructured form through emails shared by other staff. It's the data, how it's being used and who is using it that matter the most.