If my company inadvertently made money from scams, I would try to make the victims whole or donate that money. It's so scummy that they sit around waiting to be fined. It's just plain stupid management to document this in emails and not also document a good faith attempt to make it right. I always assume my emails could be made public after my entire mailbox was subpoenaed in a lawsuit my employer was involved in and I was deposed to answer questions about email threads and source code comments from years ago. (I didn't do anything wrong personally, but my employer most likely did.) If I'm going to discuss something that could make me or the company look bad, I'm sure as hell going to write it in a way that's defensible when it gets out.