To: actually isn't used in routing. MTAs and MDAs route messages based on the target address that's communicated in the 'RCPT TO' command, ignoring whatever may be in the To/CC[/BCC] lines, should the MUA happen to generate those headers.

The set of metadata used in routing, aka the 'envelope', also contains a return path, which is (normally) used for things like submitting delivery failure reports.