Question : Email recipients in BCC field can see eachother

I have a client sending a newsletter through Outlook.  She sent an email with the To and CC fields blank, and put about 50 addresses in the BCC field.  She received a number of responses from recipients who were able to see all addressees.

Some testing has indicated the following:
- When leaving TO and CC empty, BCCed addresses will be put in the TO field upon sending, meaning all recipients see all other addressees
- When an address is placed in the TO field, BCC behaves correctly -- TO and CC addressees are visible, but BCC addresses are not visible.

I've recreated the same behaviour in my environment.  Both my client and I are using Outlook 2003 to send via an Exchange 2003 SP2 server.  She has Symantec Endpoint Protection on her desktop.  I have AVG Free edition at the moment.

My questions:
- Is this normal behaviour?  Is there a setting to modify how BCC'ed addresses are handled?  It seems nonsensical for the function of BCC to be overridden if there's nothing in the To: field.

Any answers, hopefully with references I can check out are greatly appreciated!

Answer : Email recipients in BCC field can see eachother

Theres no indication that this behaviour is a bug.  It looks like an issue with how Microsoft has implemented the BCC standard.  The standards written around BCC arent clear in indicating that the To: field must be filled, or that BCC will be copied to the To field.

Basically, current usage indicates that best practices would maximize privacy and confidentiality.  The practice of putting BCCed addresses in the To: field goes against best practices, but not against standards.  In short, the behaviour in Outlook is a poor implementation, but theres nowhere that I can find it referenced as a bug that will be fixed.

Related RFCs
http://www.faqs.org/rfcs/rfc2822.html
http://www.ietf.org/rfc/rfc2076.txt