An iPhone can be remotely wiped with an Exchange account from the Exchange Server for the account only.
The iPhone includes a passcode lock feature that prevents someone from accessing your iPhone if lost or stolen or without your permission. Beginning with firmware 2.0, the passcode lock feature includes an option to erase all data on the iPhone after 10 failed passcode attempts, which must be turned on.
Apparently you weren't using the passcode lock feature if the person that stole or found your iPhone sent an email with your email account, and this person is able to access everything else on your iPhone also.
If you haven't already done so, you need to change the password for your email account that you were accessing with the iPhone's mail client, and if you were accessing multiple email accounts with the iPhone's mail client, you need to do the same for each email account.
Other than this, there is nothing else you can do at this point.
And if you are in the U.S., you did call AT&T to report your iPhone as lost or stolen?