Using WebDAV to read BCC information on messages (even in the Drafts folder) will not work. The “urn:schemas:mailheader:bcc” will not return the BCC information using WebDAV - this is expected behavior. If you do a GET against the message to get the MIME, then you will also not get the BCC - this also expected behavior. You will find similar limitations with Exoledb and CDOEX.
Extended MAPI can get to the BCC, however BCC information gets stripped when the message hits transport (ie the message is sent). WebDAV may be able to return the names associated with the BCC using "urn:schemas:httpmail:displaybcc" when the message is in the drafts folder, however not the BCC addresses.
The OWA command <http://myserver/exchange/Administrator/Drafts/test1.EML?Cmd=recips> is a non-supported OWA command, however it may give you what you are seeking. This command will likely not work under Exchange 2007. For Exchange 2007, its best to use Exchange Web Services (EWS). The OWA command “Cmd=recips” command used in an HTTP GET will reply back with an OWA HTML web page which includes To, CC and BCC information - this html content can then be parsed. Again, this approach is unsupported and not recommended.
If the message was created with Outlook/Extended MAPI, then you should be able to retrieve it with Extended MAPI. Extended MAPI needs to run in network. So, this leaves you with either using the unsupported OWA command or working with Extended MAPI. In Exchange 2007, Exchange Web Services (EWS) can be used to do what you want.