There are several forensic tools that do this but this is one that is light weight and will probably work for you: http://controlcase.com/data_discovery.php
The way it and every [most] other scanners work is to actual scan through every file and flag any number set that matches a defined set of patterns -for your case, it will be credit card numbers. Additionally, some software attempts to read the context of the number to see if it is a false positive.
Note, I'm not affiliated with the linked software or company.
Edit: Here is an open source program that claims to do the same thing (I have not used it personally) and so you should be able to configure it to run on your mail server. http://www.it.cornell.edu/services/spider/