Add an email address to a hidden field
Presumably the "to" field contains the email address of the organization with which it contacts. Since this is independent of the client, it should not be part of the form; it must be part of the script target of the form.
Even if the email address is "different" (eg, limited webmaster list, technical service, sales, complaints department, etc.), the form should not contain the target email address. It should contain a send dropdown where the option values are integers that the script uses to determine which email address is appropriate. Aside from security concerns, a parameter list like the one just described is easily generated from an array. Therefore, changes to the email list are easy to make.
Storing your email address on a contact form helps prevent your spam form from being misappropriated. And it also keeps your email address private from webscrapers.
a source to share
It's just a way to track down an email address that needs to be needed somewhere. Since they cannot figure out your email address on their own, I assume you entered it earlier, so I would not call it stealing.
As far as practices go, I'm not a big fan of hidden fields as they are so easy to change, but it can get the job done if needed. You need to have all kinds of data validation on hidden objects, of course, as if they were user inputs.
a source to share
Where is what email address?
The email address to which the form will be sent? It's not very clean, but it's okay. (If the server side form processor does not validate the email address for whitelisting, then this is a spam relay invitation and that scary).
The email address entered by the user on the previous page? No problem, this is just saving the state and it cannot be stolen - only the user who entered it in the first place will see it. (This half of the answer has been deleted in response to comments)
a source to share