test(260721-mmf): assert tenant-wide fan-out and multi-recipient blast radius

- Updated the getHeldMessages window test to assert no `recipient` key and
  added an explicit no-`to` assertion for searchDeliveredMessages
- Added a new test driving searchDeliveredMessages with 3 distinct `to`
  addresses, asserting all appear in perRecipient and count toward
  matched/delivered

lib/services/mimecast-blast-radius.test.ts

@@ -293,13 +293,85 @@ describe('getBlastRadius', () => {
     expect(searchDeliveredMessagesMock).toHaveBeenCalledWith(
       expect.objectContaining({ start: expectedStart, end: expectedEnd })
     );
+    const deliveredArg = searchDeliveredMessagesMock.mock.calls[0][0];
+    expect(deliveredArg).not.toHaveProperty('to');
+
     expect(getHeldMessagesMock).toHaveBeenCalledWith({
-      recipient: BASE_INPUT.recipient,
       start: expectedStart,
       end: expectedEnd,
     });
   });
 
+  it('returns every distinct recipient from a multi-recipient delivered result (true blast radius)', async () => {
+    searchDeliveredMessagesMock.mockResolvedValue({
+      messages: [
+        {
+          id: 'd1',
+          status: 'Delivered',
+          subject: BASE_INPUT.subject,
+          from: BASE_INPUT.sender,
+          fromEnv: BASE_INPUT.sender,
+          to: BASE_INPUT.recipient,
+          toDisplay: 'Reporter',
+          received: '2026-07-14T12:00:00+0000',
+          senderIP: '1.2.3.4',
+          spamScore: 0,
+          detectionLevel: 'none',
+          attachments: false,
+          route: 'inbound',
+          info: '',
+        },
+        {
+          id: 'd2',
+          status: 'Delivered',
+          subject: BASE_INPUT.subject,
+          from: BASE_INPUT.sender,
+          fromEnv: BASE_INPUT.sender,
+          to: 'coworker-a@wulfconsulting.test',
+          toDisplay: 'Coworker A',
+          received: '2026-07-14T12:05:00+0000',
+          senderIP: '1.2.3.4',
+          spamScore: 0,
+          detectionLevel: 'none',
+          attachments: false,
+          route: 'inbound',
+          info: '',
+        },
+        {
+          id: 'd3',
+          status: 'Delivered',
+          subject: BASE_INPUT.subject,
+          from: BASE_INPUT.sender,
+          fromEnv: BASE_INPUT.sender,
+          to: 'coworker-b@wulfconsulting.test',
+          toDisplay: 'Coworker B',
+          received: '2026-07-14T12:10:00+0000',
+          senderIP: '1.2.3.4',
+          spamScore: 0,
+          detectionLevel: 'none',
+          attachments: false,
+          route: 'inbound',
+          info: '',
+        },
+      ],
+    });
+
+    const result = await getBlastRadius(BASE_INPUT);
+
+    expect(result.status).toBe('ok');
+    if (result.status === 'ok') {
+      expect(result.delivered).toBe(3);
+      expect(result.matched).toBe(3);
+      expect(result.perRecipient).toEqual(
+        expect.arrayContaining([
+          { recipient: BASE_INPUT.recipient, status: 'delivered' },
+          { recipient: 'coworker-a@wulfconsulting.test', status: 'delivered' },
+          { recipient: 'coworker-b@wulfconsulting.test', status: 'delivered' },
+        ])
+      );
+    }
+  });
+
   it('excludes an in-window held row from an UNRELATED sender domain from held/matched and perRecipient', async () => {
     searchDeliveredMessagesMock.mockResolvedValue({
       messages: [