Email from Request to join includes other people's email address
Summary
The email sent to announce a request to join (I don't know about other emails), includes everyone else in the same To:, so even if in GitLab itself the emails aren't disclosed, they are now all available in a mail
Steps to reproduce
Create a group with several members and a new person request to join in
What is the current bug behavior?
An email is sent, and it includes other people in the To: header
What is the expected correct behavior?
Either use BCC for everyone, or send one email to each person
Relevant logs and/or screenshots
Output of checks
This bug happens on GitLab.com
Results of GitLab environment info
GitLab Enterprise Edition 9.0.0-rc5-ee 5003abb