I've implemented this before for the same exact issue because there is no "simple fix" for typo's here's how to cleanly handle it.
First a company policy needs to be written and employees need to read and sign that they acknowledge it and SANS has some good boilerplate's that can be used. The policy must state that all sensitive emails MUST be sent by using a global address book which is centrally managed. Here you put in all the correct email addresses and also confirm that they are correct before telling the users to use them and showing them how to access them. The policy needs to be very clear that ONLY the Global Access List (GAL) is to be used for sensitive emails and that if not followed may take action against the employee for disciplinary action.
Second, either completely disable autocomplete or train the users how to remove invalid addresses one at a time.
Third, train the employees of the new policy and it will only happen when they intentionally do not select the users from the GAL.
Lastly, if information is truly sensitive like patient information, credit cards, etc. then a 3rd party email encryption product should be used. If you are in a regulated industry like in medical with HIPAA and HITECH then encryption systems like this MUST be used or they can be fined or they can stick with only faxing while the recipient is waiting to receive or use SFTP/FTPS but that's a whole other conversation.