A "CC" is tacked on the end of the "to" address when you import an exported alert action.
This was confirmed as a bug from support. I haven't heard anything about when it may be fixed.
Importing and exporting alert actions seems to be pretty broken.