It is both legal and required by US law. If a company doesn't have a "system of record" that keeps track of all emails generated by employees, the company can lose their defenses against a wide array of possible legal troubles.