How did this Coinbase email get into my Yahoo inbox?

Eyeful

IvanOpinion said:

Try checking https://haveibeenpwned.com/ to see if there have been many breaches.

"Have I been pawned"" = "Have I been hacked"

 In modern day cyber security contexts, "pwned" specifically refers to: 
Being the victim of a data breach
Having an account or system intentionally compromised by an attacker
Losing control of personal digital accounts or information

bob2302

BCC doesn't actually exist outside of email composition, it's just an instruction to the mail client.. The addresses used for transporting an email are separate from the  header fields inside the email.