Steps to reproduce:
1. Configure the designated default <sendmail-message> in javamail-configuration.properties to have no "to" attribute. Set a valid mailHost in both javamail-configuration.properties and javamail-configuration.xml (not fully certain how these two sets of settings interact in all cases...).
2. Configure a valid report in reportd-configuration.xml with one valid e-mail recipient specified, e.g.:
<report report-name="Early-Morning-Report" report-template="Early-Morning-Report.jrxml" report-engine="jdbc" report-format="pdf">
<cron-schedule>0 0 0 * * ? *</cron-schedule> <!-- daily, at midnight -->
3. Wait until midnight
Report gets e-mailed to firstname.lastname@example.org only
Report gets e-mailed to both email@example.com and root@localhost. If the configured mailHost rejects the latter address, the report does not get mailed at all.
The default value for the "to" attribute of the <sendmail-message> in the javamail-configuration schema is "root@localhost", I think that's where the extra address is sneaking in.