fix to security review check based on email CC's.
- Correctly looks at mailing lists instead of users.
- no security review if no CC's
Merge pull request #5 from dropbox/security_reviews_from_ccs_fix

Security reviews from ccs fix