Even so, it would make more sense to put all the addresses in a mass email in the BCC field. Regardless of if they are enterprise clients or not. Keeping contacts safe and secure should be a requirement.
It feels kind of like the wrong variable was used for To when looping through generating the day's license expiration emails.