PM's being sent to additional people

[consolegaming]

Recently members of our forum have been receiving PM's that aren't meant for them. After some investigation into the issue I've found that the person that the message is intended for is still receiving it and it seem the extra person receiving it is just receiving a copy of the pm but I can't see any explanation or pattern for it.

The wrong person receiving the message isn't always the same person, the person who rightly receives the message isn't always the same and the type of message isn't always the same so as you can probably understand I'm hitting a brick wall at the moment.

It's happened for infraction pm's and pm's sent normally and even pm's that we ourselves create. By that I mean part of our script in our own site basically creates our own automated pm's to inform the members about an event on our site. I have double and triple checked that I'm doing this right and the function I use only gets called once per event so It's not creating these additional entries into the pm table.

Concerning the database the two pm's from the pm table share the same pmtext id as would be expected. It's almost as if the pm has been cc'd to the second person. But I can't see where this is being done. I've tried disabling some of our plugins/products but the ones that are left shouldn't affect the pm system at all.

Any help that could be given would be highly appreciated as its a bit of a security/privacy issue at the moment having people receive pm's that they shouldn't be.

EDIT: Sorry if this should be in the programming forum but as far as I can tell this is a bug/issue with vBulletin. Especially as it happens with all types of pm's: (ones I add into the DB myself, infraction ones and normal ones).