I don't think that the complexity affects the email project a great deal. The specificity of what was expected to be delivered as part of the email system, be it the security or the other aspects of functionality, was clearly laid out in the contract.
When I think of the complexity, I think of the data networks and the data centres. When you go to one of the old data centres, or go to a pseudo-data centre, as I will call it, you will see that there are wires, servers, and boxes all over the place. Just mapping what is connected to what, how it works, and where those interdependencies are is a very large exercise.