https://bugs.winehq.org/show_bug.cgi?id=49008
--- Comment #2 from Olivier F. R. Dierick o.dierick@piezo-forte.be --- Hello,
--- quote from RFC2822 --- The "To:" field contains the address(es) of the primary recipient(s) of the message. --- end quote ---
It's up to the sender to determine who the primary recipient is. The standard makes no provision about that.
It's common usage of mailing-lists and automated email services to hide the recipient address using a self-address in the 'TO' email header and to put the actual address(es) in the 'BCC' email header or 'RCPT TO' STMP command.
It's not a violation of the standard.
All the emails sent from appdb.winehq.org have the 'TO' header set to the self-address, not only the confirmation email. It has been so for years. Probably because it uses a mailing list system to send all emails. In this case it's a single-address mailing list.
As with any automated email service and mailing-list, it's up to you to teach your spam filter to whitelist the emails from that sender.
Regards.