The right to erasure / right to be forgotten only exists under fairly narrow conditions, which may or may not require erasure in this scenario.
As a general principle, when two individual's personal data is involved, we need to carefully balance both people's rights. With some GDPR rights such as the right to access, the right “shall not adversely affect the rights and freedoms of others”. For example, if person A makes a data subject access request, it would adversely effect person B's privacy rights if person B's emails were searched.
However, the right to erasure does not explicitly have such a constraint.
Instead, the Art 17 right to erasure contains six cases under any of which erasure may be requested, and five grounds on which erasure can be denied.
Let's look at potential grounds for requesting erasure.
(a) the data is no longer necessary. This does not apply, as storing the emails is still necessary in B's inbox.
(b) processing was based on consent and A has withdrawn consent. This does not apply.
(c) processing was based on legitimate interest, A has objected, and there are no overriding legitimate grounds. Likely, this does not apply: B has an overriding legitimate interest in keeping their emails.
(d) the processing was illegal. This does not apply.
(e) there's an applicable legal obligation to delete the email in EU or member state law. This might apply, but A would have to point out the specific law.
(f) the personal data was collected in relation to the offer of an information society service under Art 8. This might apply, but only if A was a child at the time (between 13–16 years old, depending on member state).
Even if there are grounds to request erasure, one of the grounds to refuse the request could apply:
(a) for exercising the right of freedom of expression and information. For example, person A cannot use their right to erasure to suppress journalistic work (but freedom of expression and information is much broader than just journalism).
(b) for compliance with another legal obligation, or for a task carried out in the public interest. For example, person A cannot use their right to erasure to force B to delete financial records that B is legally required to maintain.
(c) for reasons of public interests in the area of public health. Probably won't apply here, but it's important to note that GDPR generally prioritizes health and life over data protection.
(d) for archiving, scientific, research, or statistical purposes. Likely doesn't apply here.
(e) for the establishment, exercise, or defence of legal claims. For example, A cannot use their right to erasure to delete evidence that B needs in order to sue A, or to defend against a claim by A.
Many of these exceptions are extremely context-dependent, and cannot be resolved without taking into account the individual circumstances of person B.
It may also be worth noting that B – and not the email service provider – might be the data controller for the emails in B's inbox. Then, the right to erasure should be exercised against B, not against the service provider.
