If someone is stupid - yes, stupid - enough to log on to their personal e-mail account on their work computer, then they should assume every click and keystroke is being monitored. As an employee, I don't own my work computer. The owner of my computer is - and should be - allowed to monitor any-and-everything that happens on its hard drive.
If someone were to come to my home office and use my personal computer, there's no reason I couldn't review the web history to see which sites they visited. If they don't want me to see what they did online, then they should use their own computer.
I agree that the actions of the FDA were a bit smarmy, but the employees in question could have avoided the entire situation by signing on their home computer in their home office.