email monitoring

As a former IT director I have a former colleague who believes her boss is monitoring her email. Email monitoring is not illegal BUT the email that a copy of her email is forwarding too is her bosses hotmail account.

Is forwarding of a monitored business account to a personal account legal?

Thanks