The whole idea of BCC is to not disclose any BCC recipients to each other. An email program whose sent mails allow the recovery of BCC recipients is terribly broken.
The Exchange Online docs also confirm that they don't intend to forward addresses in BCC:
Bcc recipients are stored in the message in the sender’s mailbox, but not included in headers of the message delivered to recipients.
Ideas about what could have happened:
- Did you use BCC correctly? It only hides the list of BCC recipients. Any addresses in the TO and CC fields will be disclosed to everyone who received the mail, regardless which field they're in themselves. (That is, a BCC recipient will know who was in CC.)
- Did you use any email encryption system? There is some research, for example in this Stanford paper, on how numerous encryption systems completely expose BCC recipients due to their encryption mechanisms.
- Does the person who accessed the recipients have access to the mail server or its traffic? The messages to BCC recipients are visible in the traffic and server logs just like any other emails.
To investigate the problem further, you could send a test mail with you and someone else on BCC, and inspect the raw email data to see if there are any hidden headers indicating the BCC recipients.
If you only have a small number of BCC recipients you might prefer to first send the message to all disclosed recipients and afterwards forward it to everyone else individually.