I think they should just leave their users property alone, and act like a dumb conduit without the ability to inspect. Find other ways to solve the problem. Do what they would do if they were not in the convenient position of being the email host.
You missed that "what they would do if they were not in the convenient position of being the email host" is subpoena the email host. Unfortunately, you can't really subpoena yourself. Nor is it clear that they could subpoena the user here and compel the user to give information to Microsoft that Microsoft already has.
The EFF suggests getting the FBI involved and having them serve a court-approved warrant, but that doesn't work if you want to keep this a purely civil process and not involve the police (and given recent abuse of police powers for relatively minor crimes, getting the FBI involved is probably not something to be categorically encouraged).
