Why Can't I Mask Existing Emails?

There is a Salesforce limitation which prohibits us from updating/masking existing emails. This is the feature:

update() is supported when an email record is in Draft status, and IsPrivateDraft is false. It is also supported if Status and IsPrivateDraft are true and CreatedBy is associated with the current user. When the email record status is not in Draft status, the IsExternallyVisible field and custom fields only can be updated.

This means that once an email is sent, it can no longer be updated, even manually. Since some emails will contain Personally Identifiable Information (PII), they will need to be deleted. Before deleting the emails run an Audit with the Action set to "Report". Once you are comfortable deleting the emails, run a second Audit with the Action set to "Delete" (or delete them manually).