There is a potential security flaw in the BCC feature.
According to the conventions of the SMTP protocol, all addresses, including BCC addresses, are included in every email as it is sent over the Internet. The BCC addresses are stripped off blind copy email only at the destination email server. Therefore, if the addressee controls their email server or can access it, they could examine the BCC addresses on every email they receive.
Very occasionally, an email server will be misconfigured and not strip off the BCC list on email it sends to its local users, revealing the complete blind copy address field to users that receive the email at that domain. Therefore, BCC is very good but not perfect at keeping addresses confidential, and should not be relied on for the most critical and sensitive of communications.