Microsoft didn't search their employee's email. They searched the blogger's email, the one who wrote about and published screen shots of Windows 8. This is how they found that their employee had leaked the info; they saw his email with the blogger.