Use a proper campaign emailer
Using a proper mailing list manager would definitely have been a good idea.
My day job involves emailing up to 65,000 people at a time. Yes, these are people who have intentionally opted in to receive the information concerned.
We've been using our (hosted) provider for a year and a bit. In that time, I've sent 6,000 blank emails and a couple with broken links. These were embarrassing, but at no point did someone get a big bunch of data about other people. What surprises me is that an organisation on the scale of Everything Everywhere hasn't got both access to a proper mailing list manager and adequate rules about using it.
A south-west London branch of the budget wing of a massive French hotel chain did this to me not so long ago. It was tempting to cc the ICO into the reply...