An email is like a postcard and every server which traffics it can read the full contents. The CC details are static and will not change once you receive them, so it is in effect sending the CC details to all MX servers that traffic the email and anyone that reads it can use your CC for anything they want. I would consider it an enormous glaring security issue.