Yes, and your device read the email, so now your device is in scope. It doesn't matter what else you did with your device and their data, they now have a reason to look through your device.
Would that mean if I were at a hotel and used their computer in a pinch to access the web client (not that I ever would - keyloggers) would that be in scope?
