Hello, the disk image we are using to protect data with espionage, is mounted on the system like any other volume, be that an external physical disk, or a logical volume like disk image.
If there is an open file on the volume, the OS will not allow ejecting it, i.e unmounting it, because that would break the connection between the open file and the process which is using it, so normally you get a "disk busy" message.
If Apple decided to leave some background processes active which continue to read from Mail related files even if Mail is terminated, there is little we can do about it. We can merely find which process it is, and which file it is, but they it is you who has to decide if you want to manually terminate the process and whether that bares the possibility of ending up with corrupted data.
with the lsof command in terminal, you can get a list of all open files on the system, combining it with the path and grep to filter out, you can get a list of files which are on the mounted volume.
with command mount, you can get the list of mounted volumes with their path, here you should identify the path of the volume which belongs to the protected folder.
and then the command would go like this
lsof | grep hereyoupastethepath
give it a try and see if that reveals which file is kept open.
Rgds
Zsolt