Email from Request to join includes other people's email address

Summary

The email sent to announce a request to join (I don't know about other emails), includes everyone else in the same To:, so even if in GitLab itself the emails aren't disclosed, they are now all available in a mail

Steps to reproduce

Create a group with several members and a new person request to join in

What is the current bug behavior?

An email is sent, and it includes other people in the To: header

What is the expected correct behavior?

Either use BCC for everyone, or send one email to each person

Relevant logs and/or screenshots

Output of checks

This bug happens on GitLab.com

Results of GitLab environment info

GitLab Enterprise Edition 9.0.0-rc5-ee 5003abb