IBM Sametime Meeting Server 8.5.2 and 9.0 may send replies that contain emails of people that should not be in these messages. IBM X-Force ID: 113850.
https://exchange.xforce.ibmcloud.com/vulnerabilities/113850
http://www.securitytracker.com/id/1039231