For non-private subusers, you're right, but for private subusers, you can only read new emails after resetting the keys, you can't read existing emails. I.e. you can take control over the email address, but not access existing data.