waue_confirm_1.php is not read only. The server behaviour simply isn't removing the Bcc address from the waue_confirm_1.php file. So how do we do that manually if the extension isn't working correctly, as it appears that is our only option? Here's the line in the waue_confirm_1.php file:
$WA_MailObject = WAUE_AddBCC($WA_MailObject,"firstname.lastname@example.org");
Regarding the address at line 510 - you'd previously helped us with that, if you recall, because I'd reported that it was arriving with a blank From value. I'm not sure why that's no longer working but the new changes you've recommended above have resolved the issue and I've learnt that it's best not to ask why.