It is not uncommon to find such lines in the report "Traffic Sources> All Traffic Sources:

These visitors from different webmails whose referrer can be incredibly numerous.
The idea here is to combine all traffic within a single source that we call "Webmail".

Here are some examples of current French webmails that we can identify:

mail.google.com
mail.live.com
hotmail.msn.com
webmail.laposte.net
mail.caramail.lycos.fr
imp.free.fr
mail.yahoo.com
webmail.aol.com
mail3.voila.fr
mail1.voila.fr
mail2.voila.fr
webmail.aliceadsl.fr
webmail.calixo.net
webmail22f.orange.fr
webmail26c.orange.fr
flashmail-1t2.club-internet.fr
flashmail-10v.club-internet.fr
wmail1.noos.fr
webmail.mgp.neufgp.fr
etc..

we can cover the majority of these lines with the following expression without the risk of including too many referrers who were not webmails:
mail (.*) \ .(.*) \ .. (2,4)

This is the advanced filter to retain the kind of webmail:

Attention is the source of the campaign, not the reffers ( "External link" in the jargon GA) to be addressed

Here's what it will:

This type of filter is interesting to visitors arriving on the site by an email "natural" outside mail newsletter or purchase to be tracked in dedicated campaigns.

We tested a filter replacement to address the source of the campaign but that did not work (if someone knows why thank you from me know in comment:))