I did point out that the Gmail comparison is an aside. An aside because as you point out, neither is open source. Gmail in comparison to Exchange does, however,

I did point out that the Gmail comparison is an aside. An aside because as you point out, neither is open source. Gmail in comparison to Exchange does, however, demonstrate the benefits of controlling the environment. Apologies, I wasn't very clear. That said, compromising a sysadmin account in Exchange does not yield email content. Assuming service accounts have been correctly configured (ref. security policy). However, a Gmail sysadmin can have (and has, in the past) access to users' email content. If I wanted acess to anyone's email account I'd opt for a social engineering attack on that user directly. Given history that's the easiest vector. If you think advocating defense in depth as a strategy betrays a lack of understanding of security then, well, damn.