Your initial report emails will always go to the affected email addresses.

But future breach alerts will be sent to the Primary address. (If you select that in your preferences.)