[fastest963]

Why didn't they just send the email to the recipient? What does the BCC add in this context?

[thehappy]

BCC recipients can't see (or contact) each other to mitigate the spread. If you look at the source code, it BCCs 99 contacts from the infected account per message.