This behavior provides ability to system administrator to test & enable and then synchronize any user's (having D365/power app per user license in same tenant) O365 mailbox in to dynamics instance by changing that user's email tracking setting to "All email messages". This is can lead to a major email/data exposure situation within an enterprise where a developer having system admin in Dynamics /CDS can potentially sync anyone's email with few clicks.