While this isn't a "reply all" scenario, we have an email address prefaced with a pound sign (established before twitter hashtags) that is intended to send to everyone across the state in our department, which encompasses some 4000 employees. It used to be that anyone could send to it from an internal email account, and that was supposedly it. Well, one morning we came in and there was an email sent to that address from an external email account. Someone whose last day was the previous day, and who had not left on such good terms, had sent an email blast to that account virtually detailing his entire situation and using very colorful language describing why several of his supervisors were real dicks. It was entertaining reading. I didn't know any of the people involved. Wish I would have saved it.
Of course, that tagged account has been locked down and nobody except the real high ups can send to it now. I'm sure all the small workgroup emails are locked down as well.