In short YES.
I have seen this before where the TO: field is populated with another name yet other accounts (users) will also get this email. Depending on the header information, the information is limited. Either they’re using some sort of mass mailer that actually hides all the BCC: or CC: recipients or they’re mailing to a list and then it’s being remailed.
One of the pains of spams. Almost makes you want to go to a trusted email system.