Firms do spy on emails, study says