yes both of these can be done. you'll probably want to look at Data Classification Services (DCS) and Compliance Accelerator.

Enterprise Vault 10 Feature Briefings - Data Classification Services

I think CA still addresses some of his requirements

CA isn't going to send any alerts and isn't doing proactive monitoring of every mail in and out of the organization. It would all have to be done via scheduled searches as random sample is just that, a random sample. 

Why would you want to try and make the product do what it isn't designed to do?  There are products designed to do what he wants, CA just isn't it in my opinion.