Yep, the quick reply (ie *not* using WYSIWYG) escapes out all the xml/html tags

Here's another try, have included the CC and BCC.

USE ReportServer

GO

  SELECT    

 Schedule.ScheduleID AS SQLAgent_Job_Name,

 Subscriptions.Description AS sub_desc,

  Subscriptions.DeliveryExtension AS sub_delExt,

  [Catalog].Name AS ReportName,

  [Catalog].Path AS ReportPath,

 SUBSTRING(ExtensionSettings, LEN('<Name>TO</Name><Value>') + CHARINDEX('<Name>TO</Name><Value>', ExtensionSettings), CHARINDEX('</Value>', ExtensionSettings, CHARINDEX('<Name>TO</Name><Value>', ExtensionSettings) + 1) - (LEN('<Name>TO</Name><Value>') + CHARINDEX('<Name>TO</Name><Value>', ExtensionSettings))) AS 'To Email recipient List',

CASE CHARINDEX('<Name>CC</Name><Value>', ExtensionSettings) WHEN 0 THEN

  ''

 ELSE

   SUBSTRING(ExtensionSettings, LEN('<Name>CC</Name><Value>') + CHARINDEX('<Name>CC</Name><Value>', ExtensionSettings), CHARINDEX('</Value>', ExtensionSettings, CHARINDEX('<Name>CC</Name><Value>', ExtensionSettings) + 1) - (LEN('<Name>CC</Name><Value>') + CHARINDEX('<Name>CC</Name><Value>', ExtensionSettings)))

END AS 'CC Email recipient List',

CASE CHARINDEX('<Name>BCC</Name><Value>', ExtensionSettings) WHEN 0 THEN

 ''

 ELSE

 SUBSTRING(ExtensionSettings, LEN('<Name>BCC</Name><Value>') + CHARINDEX('<Name>BCC</Name><Value>', ExtensionSettings), CHARINDEX('</Value>', ExtensionSettings, CHARINDEX('<Name>BCC</Name><Value>', ExtensionSettings) + 1) - (LEN('<Name>BCC</Name><Value>') + CHARINDEX('<Name>BCC</Name><Value>', ExtensionSettings)))

END AS 'BCC Email recipient List'

FROM        

  ReportSchedule

INNER JOIN Schedule  ON   ReportSchedule.ScheduleID = Schedule.ScheduleID

INNER JOIN Subscriptions  ON   ReportSchedule.SubscriptionID = Subscriptions.SubscriptionID

INNER JOIN [Catalog]  ON   ReportSchedule.ReportID = [Catalog].ItemID

AND Subscriptions.Report_OID = [Catalog].ItemID

WHERE

  Subscriptions.DeliveryExtension = 'Report Server Email'