Forum

Smrithi,

$userto is an array filled in function forum_cron() in /mod/forum/lib.php
The array contains everything from table mdl_user for that one user (as well as other useful bits), hence $userto->email etc.

Function forum_cron calls function email_to_user(...) in /lib/moodlelib.php where array $userto is received as $user, so in here the email addresss is $user->email.

But within this function a call is made to &get_mailer() (also in moodlelib.php) to create a $mail object which itself contains a $mail->to array, which contains the email address at $mail->to[$key][0], and a translation for user's name to the appropriate character set at $mail->to[$key][1].
All of that is defined in /lib/phpmailer/class.phpmailer.php.

The function email_to_user(...) then calls $mail->send() obviously defined in the phpmailer class, which in turn has a VERY useful switch split between 3 types of 'mailer' - which you could so easily make 4 (though perhaps you have already???).
...and in which the to address is retrieved as $this->to[$i][0]

No wonder its easy to loose the address!!

Hope this is of help.

John