User sends message via client. Client fumbles the recipient id. Message ends up at the wrong recipient.

Examples: incorrect recipient ID attached to contact in list where users selects recipient. Buggy selection of multiple targets in the selection UI due to incorrect touch event handling. Incorrect deletion of previously selected and then deselected recipient from recipient array of multitarget message. Or if working low level even a good old off by one error and reading out of bounds data for the recipient list (though that one hopefully should trigger a faulty send request due to other stuff no longer matching). There is endless examples.

The server can't really safeguard against the client providing a legitimate send request even though the user intended to send it to another recipient.

Yeah, I don't know how they manage to get bugs like that, but it's happened