"It's not helped by Outlook hiding the BCC box by default. If MS have the sense to check for the word 'attached' in an email and warn about forgetting the attachment, you'd think they'd do something about 100s of to or cc addresses."
Our company recently switched to O365. Outlook defaults to reply-all. Even the Android app does too. You have to click the tiny arrow on the button to change it or go into the settings to change the default. There is evidence in my inbox that demonstrates that at least some people in the company haven't figured that out yet.