Since being thrust into using GSuite / Google Workspace, I found the GAM tool on Github incredibly valuable.

We recently have a spear-phishing attack sent to a number of users in finance pretending to be the CFO. I was able to test and then remove all the emails from users mailboxes by using the following command:

gam all users delete threads query from:[xyz]@gmail.com doit

You can read more on the command here.