Nathan, unfortunately I'm not aware of a way to accomplish this safely. Can you submit a ticket on this so we can check in with development on it?

We too have had requests to be able to retroactively remove all emails that contained a certain code or mark (e.g. confidential information shared by a partner which needed to be destroyed after the collaboration was over), but there is no way to do that. It would be great if a way would be implemented to allow for the such removal, even server-wide (from all accounts, live and archive). Of course, something like this should only be available to server administrator (or maybe also to domain admin, not sure).