Why does the business have email? What specific business requirements are being met? Are these requirements best met with individual email accounts or with a general email - say an "info" or "order" account @company.com?
If there is no business requirement that can only be met with email accounts assigned to employees, then the security and privacy issues are resolved with the generic accounts. Problems avoided.
If there is a business requirement for individual email accounts, a corporate policy on acceptable use is a linked business requirement. This is a good place to address things like outbound attached files.
Next is a clear definition for which manager has responsibility and authority to insure compliance and take action on non-compliance. IT is rarely the appropriate department. Where IT has a role, it should be via automated process - perhaps harvesting and reporting to managers the origination and destination of emails for people in their groups.
Virus scans and spam detection can and should be handled as a matter of process, not policy, and be done on all inbound emails via automated systems or contracted services.
