Both Rebekah Brooks and Andy Coulson were warned as early as 2006 that there was evidence of widespread hacking at the News of the World, according to an email that was submitted in evidence to the Leveson inquiry.

The internal News International (NI) email shows an unnamed police source told Brooks there were between 100 and 110 "victims" while the News of the World was under criminal investigation for hacking phones in the royal household. She was also told there were records suggesting NI had paid more than £1m to Glenn Mulcaire, the private investigator employed to carry out the hacking.

The email from NI lawyer Tom Crone to the then News of the World editor, Andy Coulson, sets out what the police knew and the steps they were planning to take in their first phone-hacking investigation. It was based on information that Crone says had been passed to him by Rebekah Brooks, then Wade, who was the editor of the Sun at the time. She had been News of the World editor before Coulson.

"They are confident they have Clive [Goodman] and [Mulcaire] bang to rights on the palace interception," says Crone's email to Coulson.

The email told Coulson that police had recovered payment records from News International to Mulcaire: "The only payment records they found were from News International … the News of the World retainer and other invoices. They said that over the period they looked at (going way back) there seemed to be over £1m of payments."

Both Brooks and Coulson have repeatedly denied they had any knowledge of phone hacking in the years after the successful prosecution of royal correspondent Goodman and Mulcaire in 2007, although Coulson resigned from his position to take what he termed "ultimate" responsibility.

The email was sent at 10.34am on 15 September 2006. Crone begins: "Andy, here's [what] Rebekah told me about info relayed to her by cops."

It then sets out 10 key developments about what the police had discovered after arresting Mulcaire and raiding his premises.

"Their purpose is to insure that when Glenn Mulcaire comes up in court the full case against him is there for the court to see (rather than just the present palace charges). All they are asking victims is 'did you give anyone permission to access your voicemail?' and if not 'do you wish to make a formal complaint?'," says the email.

"They are confident that … they can then charge Glenn Mulcaire in relation to those victims. They are keen that the charges should demonstrate the scale of Glenn Mulcaire's activities so they would feature victims from different areas of public life, politics, showbiz, etc."

The email shows that the police source had told Brooks that raids on Mulcaire's premises had recovered voice recordings and notes from them.

But the extensive email, read out by Robert Jay QC at the Leveson inquiry, also seems to show the officer had said the police investigation would be limited in scope: "They suggested that they were not widening the case to include other NoW people but would do so if they got direct evidence … say, NoW journos directly accessing the voicemails (this is what did for Clive)".

Another passage outlines the strength of the police case at that time: "They do have Glenn Mulcaire's phone records which show sequences of contacts with News of the World before and after accesses. Obviously they don't have the content of the calls so this is at best circumstantial."

The email goes on to say police knew the pattern of victims being targeted, and which ones detectives would visit. The email says police were "confident" five to 10 victims would co-operate with a prosecution of Mulcaire. The email ends by saying: "They are going to contact RW today to see if she wishes to take it further". RW most likely refers to Rebekah Wade.