I think I misinterpreted your comment tbf, I read it as `I insert a random & somewhere in the cc field` rather than `I put a sole ampersand as the content of the cc field`.

I had a colleague accidentally email a customer the results of some medical test he'd undergone instead of a report. Recall didn't work.

I think this only works if both sides are on exchange, with outlook connecting directly to exchange, it's enabled on both sides and there are no mail servers in between. Otherwise it doesn't seem to work, even when you're using O365 as the client. You just get an email saying 'name would like to recall the message'

You can have `&` in email addresses, practically anything is valid via quoted-printable. That sounds like a bug in the email server or client.