The latter go first as they "empower" the first to do so. But even in IT-Companies with Security Background, especially the management will never get it. 350+ Users addressed not using BCC. One day I'll hit the reply all button and tell them to think about BCC