Would it make sense to just always put the recipients in the BCC field to ensure you don't accidentally leak email addresses if/when something like this were to happen again?
Not really. They thought they were emailing administrators at the one organisation. From the recipients point of view, it would be much easier to deal with if you saw who it was going to. A bunch of BCC recipients within the same organisation is going to lead to confusion.
Yeah. Is there a strong argument against sending separate emails though? Selfishly curious because that's one of the things we've been doing to prevent this sort of mistake.
A lot of enterprise spam filters are triggered by a burst of incoming mail from a single sender, sending one email with a bunch of to: is less likely to trigger them.
I've had to deal with too many stupid spam filters in my life.
I suspect there are spam-filter considerations. Also, some email clients distinguish between "email addressed directly to me" and "email I happened to get through some mailing list or bcc".
