There is a way to solve this but not sure if it's worth the hassle! You can hide PM ids on the PM_publisher/ page. Anyone who sends a publish request has to provide the the sender username and the correct PM_id as arguments. If they match then he is indeed a BCC recipient. You'll have to limit the number of requests a user can send (i.e 5 per day) to prevent him from trying to guess the correct id.
It's not worth the hassle indeed. And it can still be tricked by a scammer: there could be more than one BCC. Or the scammer could use any other account to pretend to be the BCC recipient.