Use Velocity to generate email

 > Then I would have to copy toAddress and additionalAddresses to another collection/array, eg actualAddresses.  I don't think it would be worth it.

It seems like a small cost, for the benefit of having the compiler tell us the moment we break the requirement for having at least one address. By making the requirement explicit in the signature, there is less room for human error.