In the case of using the preview pane, there's a subtle case of displaying external images (img src in HTML) where an attacker can get an idea of what content is getting past email filters. The client will just download the image automatically, and the attacker's webserver logs the activity. I think that can be turned off in various email clients, but folks have to be savvy enough to know to do it.