security and BCC

We have a question among some of our users about whether putting e-mail addresses in the BCC box provides pretty good or complete security for sensitive information. Specifically, there is some belief that knowledgeable people could hack the e-mailand find out who else the message was BCC’ed to, which could present a problem for some of our clients. I can’t find anything about this out there regarding this being truthful (and if so, how easy or unlikely is it) or being a “legend”. Can anyone comment on this possibility (without giving details for how it may be done if it can be)?
Thanks.