My old university computing society did the same. Nice email with 1000 emails in 'To'.
A fairly friendly (but a bit arsey) email later and I got a data breach email from them the next day announcing what they'd done.
And yeah. I also work in a place where 'Reply All' is pretty much the default option. Cue hundreds of email a day.