Magento Order Emails – Order Emails Sent Only to Customer, Not Admin

TL;DR: use the "Bcc" option instead of the "Separate Email" option for order copy emails, because the latter is seriously broken in Magento 1.9.1. It will expose your copy email addresses to the customer.

There is something fundamentally broken with how Magento is handling this. When you have multiple (comma-separated) email addresses specified in "Send Order Email Copy To" with "Send Order Email Copy Method" set to "Separate Email", Magento creates multiple separate messages in the core_email_queue table - one for the customer and one for each Copy recipient.

(example: set to copy to test@example.com, foobar@example.com)

message_id    entity_id    entity_type    event_type    message_body_hash
4             19           order          new_order     b0faf3b948557fc38cf1ef564d0db16e
5             19           order          new_order     b0faf3b948557fc38cf1ef564d0db16e
6             19           order          new_order     b0faf3b948557fc38cf1ef564d0db16e

That is fine - it has created separate messages for each recipient.

However the actual recipients are stored in another table - core_email_queue_recipients. This is where the problem is. Instead of assigning one recipient to each message, this is what happens:

recipient_id    message_id    recipient_email
13              4             foobar@example.com
14              5             foobar@example.com
15              5             test@example.com
16              6             foobar@example.com
17              6             test@example.com
18              6             customer@example.com

it assigns 1 recipient to the first message, 2 to the second, 3 to the third etc. The more recipients you have added to the Copy field, the more emails the last email on that list will receive.

What should have been added to core_email_queue_recipients is this:

recipient_id    message_id    recipient_email
13              4             foobar@example.com
14              5             test@example.com
15              6             customer@example.com

What is worse is that the emails are no longer "separate" because the email sent to the customer will have included in the "To" field a list of all the other email addresses (which should have been sent separately and without knowledge of the customer) - thus exposing to the customer your entire copy list.

Fixing this issue requires overriding and substantially rewriting the broken copy logic in Mage/Sales/Model/Order::queueNewOrderEmail() as well as Mage/Core/Model/Email/Queue, which isn't trivial to do.

A short term fix is simply to change the copy method from "Separate Email" to "Bcc" - this option works as expected and will only generate one email.

There are two separate sections that handle the Magento emails:

1. Store Email Addresses define addresses for senders of mails sent by the system. (General, Sales, Support)

2. Sales Emails define which emails are sent and by which sender (as well as sending a copy to an admin if you would like to receive one).

3. System->Configuration->General->Store Email Addresses are only the sender addresses that will appear in the emails sent. These fields have nothing to do with admins receiving emails or order notifications. It's just a place to define sender email/return address for the system to use in the header. General Sales, Sales Representative, Support, etc.

4. System->Configuration->Sales->Sales Emails is where you configure which of the Store Email addresses you specified in the Store Email Addresses section will be the sender of New Orders, Comments, Invoices, etc. By default, customers receive new order emails from the Sales Representative email address defined under Store Email Addresses

Sales Emails is where you configure the system to send a copy of an order to you as the admin, under (Send Order Email Copy To:)