You are correct. :)
Maybe reducing the max number of recipients to the hundreds would help reduce the chance for abuse while still keeping your core customer base happy? It might also reduce the risk of getting booted off the Chrome Store.
True spammers are sending spam to many orders of magnitude more recipients. They are not going to use this tool.