I don't know if you can lock out the administrator. How would you repair the mailbox if there's corruption?
Sysadmins are sysadmins in part because there's a layer of implicit trust for the high ranking system administrator. Sysadmins can read any data on the server, read emails, sniff traffic, reset passwords...essentially they are gods within the network and servers.
If you don't trust the system administrator, you have an issue.
This is an HR and policy issue, not a technology issue. You need clearly spelled out policies that dictate what can and can't be tolerated. Otherwise, they would need to know that even if the mailboxes are secured, sysadmins could use packet sniffing, screen capture, etc...and if you managed to somehow lock out the administrator, good luck retrieving mails, diagnosing issues on those machines, and finding out if someone else installed malware on those workstations and is reading those messages!