The SMTP protocol doesn't really use values of To, Cc or any other headers, to determine recipients of the message. When MUA offers an UI to specify the recipients, it merely uses To, Cc, and other fields for both purposes of specifying the values of the corresponding headers, and the destination addresses of the message. JavaMail is merely a MUA (from this point of view). This flaw is greately used by spammers, as you've most likely observed.
There are two ways you can achieve what you need. First, do not set the 'To' header, and use 'Bcc' instead (RecipientType.BCC). That, however, would only result in having NO destination address specified (most likely an MTA will rewrite the 'To' header's value to '; undisclosed recipients'.
Another way, is to set 'To' field in the outgoing message to what you want to be in the header, and then use Transport.send(Message, Address) method to deliver the message. In this case, values of the delivery fields in the header (To, Cc, Bcc) will be ignored.