I just added a comment to bug 87606: "This is still broken in imap-2002b-6. Surely you can't ship the next release with this still broken!" Because I mentioned the next release, I clicked the box to make the bug private before committing my changes. I noticed that when I subsequently committed my changes, E-mail about them was sent to someone on the CC list of the bug. It appears that if a bug is converted from public to private, people who added themselves to the CC list before the conversion will continue to receive E-mail about the bug, and said E-mail may contain private information. This seems like a problem.
Red Hat's current Bugzilla version is 2.18. I am moving all older open bugs to this version. Any bugs against the older versions will need to be verified that they are still bugs. This will help me also to sort them better.
The Cc list accessible checkbox needs to be unchecked when making the group change, otherwise this will occur. This is a Bugzilla design issue and is best addressed with the upstream community at http://www.bugzilla.org.