How is this possible? Phishing, Bug, Hacker?

Your email address is likely in the BCC field where you can't see it. It is common for scammer/phisher emails for the Too email address to be the sender's email address or some forged email address.

The TO name is a list with the name of the purported sender. The list is probably hundreds if not thousands of automatically generated e-mail addresses.

The sender's name and mail server name are probably forged. They might belong to a real user, and the unfortunate's mailbox is now overflowing with bounced messages that he did not send.

It is just spam. Delete it.

Have a nice day.