Magento – Duplicate Order Confirmation eMails

TL;DR: use the "Bcc" option instead of the "Separate Email" option for order copy emails, because the latter is seriously broken in Magento 1.9.1. It will expose your copy email addresses to the customer.

There is something fundamentally broken with how Magento is handling this. When you have multiple (comma-separated) email addresses specified in "Send Order Email Copy To" with "Send Order Email Copy Method" set to "Separate Email", Magento creates multiple separate messages in the core_email_queue table - one for the customer and one for each Copy recipient.

(example: set to copy to test@example.com, foobar@example.com)

message_id    entity_id    entity_type    event_type    message_body_hash
4             19           order          new_order     b0faf3b948557fc38cf1ef564d0db16e
5             19           order          new_order     b0faf3b948557fc38cf1ef564d0db16e
6             19           order          new_order     b0faf3b948557fc38cf1ef564d0db16e

That is fine - it has created separate messages for each recipient.

However the actual recipients are stored in another table - core_email_queue_recipients. This is where the problem is. Instead of assigning one recipient to each message, this is what happens:

recipient_id    message_id    recipient_email
13              4             foobar@example.com
14              5             foobar@example.com
15              5             test@example.com
16              6             foobar@example.com
17              6             test@example.com
18              6             customer@example.com

it assigns 1 recipient to the first message, 2 to the second, 3 to the third etc. The more recipients you have added to the Copy field, the more emails the last email on that list will receive.

What should have been added to core_email_queue_recipients is this:

recipient_id    message_id    recipient_email
13              4             foobar@example.com
14              5             test@example.com
15              6             customer@example.com

What is worse is that the emails are no longer "separate" because the email sent to the customer will have included in the "To" field a list of all the other email addresses (which should have been sent separately and without knowledge of the customer) - thus exposing to the customer your entire copy list.

Fixing this issue requires overriding and substantially rewriting the broken copy logic in Mage/Sales/Model/Order::queueNewOrderEmail() as well as Mage/Core/Model/Email/Queue, which isn't trivial to do.

A short term fix is simply to change the copy method from "Separate Email" to "Bcc" - this option works as expected and will only generate one email.

Confirmed, the external module was causing the issue.

I disabled the module and the order confirmation email came through.