This is the best place in SE I can find to post this.
We have an ex employee who created a gmail account for work purposes that looks like firstname.lastname@example.org
He left the company and refuses to surrender the password to the account. Do we, the company, have the legal rights to stop him from using the account? Or do we have to wait until he actually intentionally misrepresent our company before we can take action against him?
This email account came about because he is one guy who travels around. At one time when he needed to send an important email, he could not access his email@example.com email. So he went ahead to create that gmail account to finish the job. Since it was an important email that had to go out, nobody frowned upon that and the gmail account continues to be in use. Now that things turned sour, we realized we could not do anything.
Maybe the moral of story is: His dedication to service excellence was admirable, but we should not allow it to happen at the expense of IT security.