My point, perhaps not made clearly, is that there better NOT be a way to hack the list. When I use BCC, I want it protected. I don't want you, or anyone else, to see whow was BCC'd.
I doubt it can be hacked unless you get "inside" the email system. I think BCC causes the list of recipients to not be included in the email package. So it isn't there at all in the email you received. It is present only inside the system, from the sender's "sent" email list.