I observed a rather strange behavior on an email that failed to deliver to a yahoo address for policy reasons.  Upon looking closely at the issues, I noticed that a forum notification went out by email when a user with email starting with "jv" posted something on the forum...  and the odoo instance initiated a forum notification email with user email starting with "jv" as the sender and user email starting with "m..." as the recipient. Both emails are yahoo emails.

See screenshot here: 

I was surprised to see this because it means that my odoo instance reveals two user emails to each other when sending forum notifications.

When looking in the back end user "jv... " has portal access, but user "m..." just had a contact but did not have portal access....

Is this expected behavior or is this an exploit that took place? I did not expect a notification going out to forum subscriber to ever show the email of the person who submitted the comment on the forum post, as the sender and thus being revealed to the user(s)!

Please advise and let me know how to fix this... I expected all forum notifications to always have the catch all email as sender...