hmm, maybe developers saw RFC 2368:

A mail client should never send anything without complete disclosure to the user of what is will be sent; it should disclose not only the message destination, but also any headers. Unrecognized headers, or headers with values inconsistent with those the mail client would normally send should be especially suspect. MIME headers (MIME-Version, Content-*) are most likely inappropriate, as are those   relating to routing (From, Bcc, Apparently-To, etc.)
 
Note that some headers are inherently unsafe to include in a message generated from a URL. For example, headers such as "From:", "Bcc:", and so on, should never be interpreted from a URL. In general, the fewer headers interpreted from the URL, the less likely it is that a   sending agent will create an unsafe message.


http://www.faqs.org/rfcs/rfc2368.html