Lots of people, starting with the system administrator of every machine your mail touches, plus anyone who has hacked those machines, plus anyone who is eavesdropping on any of the networks passed. Let's take this one at a time. E-mail rarely goes directly. Instead, they pass it off to a mail server for actual delivery. The mail server may pass the mail on to a higher-level server, especially for Internet email which passes through a firewall machine.
Inbound mail is vulnerable as well.
UNIX users go through a similar dance, though in their case the mail is likely to be read by someone who has logged in remotely to the mail server, either via rlogin or via an X window. The real point, though, is that the mail will sit on the disk of each of these machines for some amount of time. That makes it easy pickings for anyone with privileged access to those machines. Even the originating and receiving users machines are vulnerable, if not directly then via their network usage. For example, if the user relies on a network file server, that machine has the actual mail.