At 13:44 +0200 on 04/01/2007, Frank Ellermann wrote about Re: More
references in 2821bis:
[[ Oops, "Apparenly-To" is already mentioned in 7.2, I've added it
to <http://permalink.gmane.org/gmane.ietf.message-headers/37> ]]
You show the text as "This header field was never formally standardized, it
was used by a mailer in absence of a To: header field derived from
the envelope RCPT TO addresses, thereby disclosing addresses of blind
carbon copies."
While the lack of To: Header is accurate, I seem to remember that it
ALSO needed the absence of a Cc header to trigger this injected
listing. IOW: So long as SOME address (even only a comment in parens)
was supplied in EITHER the To or Cc header it would not expose the
Bcc (or MAIL-TO only) addresses. Someone please confirm or deny this
behavior.