Does the admin have full access to the email or is the view in the web console restricted to the header? Is it possible to set this at best?

Generally, we do not store any messages unless archiving is active. Only blocked messages are available for 14 days in quarantine and can be viewed in full or downloaded.

If the archiving is active, you as admin can also view all messages of the domain via the web interface in the log search and access their headers. Normal e-mail users can only view the messages of their own mail address.

Without activated archiving this is not possible. Without activated archiving you can only access the information in the log search (date, sender, recipient, subject, etc.).