I read about this last week. Not positive it applies in your case, but
worth looking at:   http://secunia.com/advisories/12376/
"*Description*:
Juha-Matti Laurio has reported a weakness in Outlook Express, which may
disclose email addresses in "BCC:" fields to other recipients.

The weakness is caused due to an error when sending multipart messages.
This may allow recipients in the "To:" and "CC:" fields to see the email
 addresses of recipients in the "BCC:" field."
More at the site above.

colin joyce wrote:

>I prepare a monthly Newsletter that I disperse via email to 80 =
>people.  I usually address it to myself and the others are always =
>included in the BCC line only using the name of the group, e.g. =
>XXXComputer Users Group.  What happens is that each of the recipients =
>gets the Newsletter PLUS the full list of names and email addresses of =
>the whole group instead of simply 'other recipients'.  I am using OE 6 and obviously use BCC for privacy.
>
>I am using a new computer, Pentium 4, XP Home and XP Office, and Outlook Express 6.    I have had a look at Microsoft's support  but have not found any clue to this occurrence as yet.   It would be greatly appreciated by me and the whole group if someone has the answer, particularly as I have stressed the use of BCC in similar cases.
>
>
>
>
>

                         PCSOFT's List Owner's:
                      Bob Wright<[log in to unmask]>
                       Drew Dunn<[log in to unmask]>