The user would need to complain of any missing emails before IT staff would attempt to find them. Exchange backups were only held for 6 months and then recycled according to some accounts. If those reports are accurate, then at best they would have been able to get a snap shop of her mailboxes back to Jan 2011 or there about. The retention policy didn't change until the IG investigation got underway.
You got it wrong. The user did complain after her hard drive crashed. The hard drive crashed and was in the hands of the IT professionals way before the backups were destroyed.
Tell me what they recovered on her new drive? And why are we shifting focus to something that happened 3 to 6 months after her new hard drive was replaced? I repeat they had a good backup at the time of the crash. Why wouldn’t they recover the emails when they repaired her computer?