It's probably a list, so the actual email has only one recipient. Something essentially expands this list to deliver a separate message to each individual recipient.

I'm surprised that lists of certain sizes aren't locked down.

I would expect the server to refuse to send to "[email protected]" unless the sender is on some sort of pre-approved list.

One would really hope that such an address cannot be externally addressed ;)

I look forward to another cleverly-named security flaw that allows someone to take down entire e-mail servers with a single externally-sent email.

The domain is nhs.uk ;)

The domain is .nhs.net ;)

Some individual trusts have @trust.nhs.uk addresses, most - probably two thirds use the .nhs.net system.

Most email servers support that behavior, but it's a list-specific setting. Just because a list is large doesn't mean there's a point where you always want to restrict replies.

If it was a list, the list owner would have disabled posting to it by now.

That's exactly what they did do though. See http://support.nhs.net/servicestatus by 09:45 they'd disabled the distribution list and updated their service status page. There were that many emails in the system that at 15:30 people were still receiving emails sent at 09:30.

Sounds like a DL Group to me..