I've been using Roundcube as my main web mail applicaition now for a few months. A couple of days ago I sent an email out to a list of recipients (about 20 friends), all in the BCC field, in order to prevent people from replying to everyone on the list. One reply I received was from someone asking why they could see everyone's email address in the BCC field.
I've just upgraded to the latest CVS version (about 10 minutes ago), and tested again. It seems that RoundCube is including the BCC header as a regular header in the email and thus it's being sent to everyone. Fortunately I was just using the BCC header to control replies and it didn't really matter that others could see each others info. But this has the potential to cause some serious problems. Imagine emailing your girlfriend explaining how she's not being rational, and bccing a buddy cause it's so funny, and then she see's you'd bcced him! Not going to be a fun time! lol.
My Config: Using PHP 4.3.10, on Apache 1.3. qmail is the smtp server, and RoundCube is configured to use smtp, not mail().
-- Dave