What should be done with an employee's company email account after their termination?

We typically change their password and forward their email to another company account so that no sales leads, etc. are missed. Is this the best way to go about it? Is this legal?