I was wondering what hardware could be used to bypass a VPN and get a user's email for example.
This is impossible from the outgoing network connection port (assuming the VPN is correctly configured). If it wasn't then any party between the client and remote infrastructure could MitM the connection.
So hardware wise you'd need something inside the machine with access to either the relevant data or VPN configuration - like a malicious CPU/RAM module. If you've got that level of physical access then if the disk is unencrypted it would be far easier to just inject a software hack.