I'm not really sure what you are doing here from this code snippet, but assume somewhere you are searching a mysql db.
This line of code
</option></select></td><td><input name="to" type="hidden" value="<?=$username?>">
sets the submitted variable $POST['to'] to the last username in the drop down menu NOT to the one you subsequently select, whilst the submitted variable $POST['to2'] should contain the selected email you require.
There are two ways round this. After you test to see if the form has been submitted, you can do a search for username in the db where email address is $_POST['to2'] or you can use javascript to update the value in your hidden field in the line quoted above before the form is submitted. I would do the former as I don't profess to know very much about javascript.
HTH - Blu