A user with domain management rights in Google G Suite can read another user's email if he resets that user's password and then uses that password to enter into Gmail.

Another possibility is if the G Suite administrator has Google Vault enabled. Google Vault is included in the G Suite Business and Enterprise packages and can be purchased at extra cost if you use the Google G Suite Basic package.
Read more about Google Vault here: https://support.google.com/vault/answer/2462365

Also, a Google G Suite user can delegate access to his/her own mailbox to another user.
Delegation functionality is not enabled by default on a Gmail domain, but the domain administrator can enable it.
Read more about delegation here: https://support.google.com/mail/answer/138350

A Google G Suite partner, like Hosterion, has default administrator rights on a domain that is associated with it.
These rights are useful if the Google Partner provides support to G Suite users.
But these rights can be disabled as follows: https://support.google.com/work/reseller/answer/6184379

For any further information, please contact us!