The admin guide says
“Endpoint Prevent monitors the most common email applications, Microsoft Outlook, and Lotus Notes. It can monitor and prevent any information transferring from these applications regardless of the email protocol. Attachments as well as content in the subject, body, and footer of the message are analyzed. Incidents include information about the sender, recipient, and the e-mail message.”
Question is: When is the check done? When the send button is pressed?
The scan occurs, when you click Send. You may see the popup occur at this time that its scanning for sensitive content. With email blocking on the endpoint the email will stay open by design and not go to the draft folder.