Businesses do hold customers' email addresses. These are routinely stored and communicated between the businesses' internal IT systems. There is nothing illegal about this.
The only difference that internal email communication makes to the above is that not just machines but employees see the customers' email addresses. So, essentially the question is: is it legal for a business to show its customers' email addresses to its employees?
As per Australian Privacy Principles, personal information needs to be kept secure. Businesses therefore have duty to do their best not to leak customers' personal information (which includes email addresses). Limiting the circle of people who see personal information only to those who need to see it is essential to perform this duty.
So, essentially, the answer depends on whether all those people CC'ed actually needed to see the email addresses for business purposes. If, for example, one of those people was your office cleaner, then you have done bad job in performing your duty to secure personal information. Should that cleaner leak the email addresses outside the business, you will be held liable.