Can anyone explain why people leave their servers configured to allow arbitrarily long To: lists? Any large organization is just one mistake away from a Reply-All apocalypse.
This may be a mailing list, rather than a simple 'Reply-All' thing (and the media have misunderstood). The reply box will be a single address if that's the case.
If so, there's ways of limiting who can address that address and in so doing spam the entire company.
At the very least, the operations accounts, security, newsletters and Simon Stevens himself should have the ability to send a network-wide email - outside of that there's no good reason for Johnny intern to be sending an email to that many people.