[pxx]

The "to" line is just a header and you can put whatever you want. The actual recipient is specified out of band (RCPT TO). This is how "bcc" works.

Likely the To: line is some sort of mailing list in this case. The mailing list watermarks when redelivering to everybody. The To line remains unchanged. A reply-all causes one copy to be leaked (but it might be re-watermarked, depending on configuration...) Edit: A reply further down says it was actually a forward which does seem more likely, but nothing about the original setup is impossible.