The scan results HTML will show in any email forwarding and email replies as it becomes part of the email the user has received. This is much the same with other security that is provided by inserting information into the email, such as those that insert text like “external message” etc at the top of emails.
The scan results information inserted does not contain any personal data and if someone else was to click the ‘learn more’, they would not see the scan results page that is intended for the user and instead, would see some information about what OnINBOX is and some generic information about what the results mean.
You can view what an external person would see by pressing on ‘Learn more’ while not logged in or by being logged in to a different account than the scan results are intended for.