What you see is pretty much normal - there is really no connection to what you see in the 'Send to' field, and the user that the mail was actually sent to.
It is typical for spam emails to include some fictitious email address in the 'to' field, but for the message to actually be sent to other users. I've seen this many times in the past.
It's due to the way that the SMTP conversation takes place - during the initial connection, the sender specifies RCPT TO (which in a normal conversation should be the recipient, but does not have to be), and later in the SMTP transmission the 'To:', 'CC:' and other fields are transferred.
As i recall, the RCPT TO field is who the actual email will be delivered to, and I think you should be able to see this in your SMTP server logs.
If you view the email header (View -> Show -> Page Source) as I recall you can see both addresses listed, both the fictitious 'To:' address that you see in the message, as well as the recipient of the message (In the last 'Received:' line, i think....)
It's been a while since i've tracked this ba
Hacker send a threat email to a add... (Ronnie Shen 25.Nov.18)
Feedback response number WEBBB6VK5Y created by Mark Taylor on 11/26/2018
. . View 'Page Source'... (Mark Taylor 26.Nov.18)
. . . . No, I also send a test email to th... (Ronnie Shen 26.Nov.18)
. . . . . . config doc (Barry Shapiro 27.Nov.18)