128 votesNick Spacek commented
Looks like I got it a little bit wrong. Below is a good link on how SMTP servers work, but regardless of the mechanic it would be impossible for the SMTP server to send a message without being told where to send it, so Mailtrap's SMTP server has the BCC addresses somewhere.
Quoted from another comment:
According to this StackOverflow post: http://stackoverflow.com/questions/2750211/sending-bcc-emails-using-a-smtp-server, Mailtrap's SMTP server should be receiving a list of all of the destination addresses from the RCPT TO command. It seems like the BCC addresses could be determined by comparing the headers of the received message and the RCPT TO.Nick Spacek shared this idea ·