Delivering to the personal inbox should add the user to the list of receivers

There is a difference between the shared inbox and the personal inbox: While the shared inbox does the delivery upon "to" and "cc", the personal inbox additionally has to add the person to the list of receivers. See here: https://www.w3.org/TR/activitypub/#inbox

In general, the owner of an inbox is likely to be able to access all of their inbox contents.

This is important to make the BCC transport work.