Currently on all emails sent from the system, the entire list of BCC email address' is added to every email sent, even an End User's forgotten password email.

It would be preferable that the End User's newly generated password was not broadcast to all the BCC email address' for security reasons.