This is simply one expression of the corporate protocols in which privacy does not exist. It's not a bug. It's not an honest mistake. It is an implementation detail of a higher level abstraction.
Of Course this isn't a bug- It's a feature. the only problem is that there isn't a confirmation screen when it detects that you have put a person's email address in the incorrect spot. All that is needed is for a popup to ask "Would you like to send this event to email@example.com?".
