The log message includes the list of envelope recipients for the message. That means it also includes BCC-recipients!

 warn    spam        = nobody
         add_header  = X-Spam-Status: spam\n\
                       X-Spam-Score: $spam_score
         # ...
         log_message = Spam received: score=$spam_score; sender=$sender_address; recipients=$recipients