Should I Have Access to My Clients’ Contact Form Submissions?

I run a small business that builds and manages websites for local businesses. Recently, one of my new clients found out that I have access to the contact form submissions from their site, which I manage using Nodemailer to send those submissions to their email. He was unhappy about this and requested that I remove my access. We did sign a contract that states I can access those submissions, mainly to protect myself in case of illegal content, DDoS attacks, or to improve spam filtering. I don't typically look into the submissions beyond checking if they're legitimate. But I'm starting to wonder, should I really be able to see these submissions, or am I unintentionally coming off as shady? While other clients haven't had issues with this, I understand the privacy concerns. What do you think?