'User error' would be the only way, but then users do make errors.
Someone could set up a scheduled reminder and forget to limit recipients to those in the "OK to email" group.
Someone would ignore do not email and the red email address, click on the email address and send an email outside of civicrm but still coming from the organisation.
Either could happen, so IMO removing the email address is the only way to guarantee they don't.
Adding to QA for 4.4 release