> is there any legitimate use to have a BCC header present
Have you checked the fine documentation?
RFC 5322 Internet Message Forma
3.6.3. Destination Address Fields
look for "Bcc".
(it's fairly long and there are probably more places in the RFCs
about this, e.g., RFC 5323).