Very capslocky
Flagging is pointless as either someone should be allowed to export that much data or they shouldn't - no one will react to a notification that someone has done something they are permitted to do and by the time it has been emailed to a journalist it is far too late.
Similarly password protecting an Excel file is next to useless and near-impossible to enforce.
Putting information to which there should be limited access in contact with tools that are designed for the easy dissemination of information (and both SMTP email and Excel are really very good at this) is the problem and removing the convenience these tools bring is bound to affect how people work - there's really no point doing anything that doesn't.