@Wes - Thanks for the thoughts. It seems that Mail.vb is used directly by a dozen or more .ascx files as well as inside modules and membership providers. Maybe commercial modules will use it too. This means a custom membership provider may not help as there could be functionality that uses Mail.SendMail that needs to be tested elsewhere . The custom membership provider would need to know that the email address was being requested for use in an email rather than for any other purpose (user details form form example).
If the asp.net class SmtpClient had a SendStarted event as well as a SendCompleted event, then it might be simple. Until then, I could always add this event in a wrapper class (two send methods each with two signatures would need to have the SendStarted event fired) around SmtpClient then use the wrapper in Mail.vb. Then an httpModule could sort out the test address.Still core changes though as I can't directly inject the wrapped class into Mail. Besides, It gets complex here as MailMessage.To is read only.
Maybe the core team could be persuaded to add (in 4.8.04?) a SendPreparationStarted event in Mail.SendMail to allow for changes like this and others? I imagine a future release will have dependency injection, but that is probably a long way off.
So for now, if I need to change Mail.vb anyway, then I can simply add the 3 lines of code needed to test for a cookie (with Test Address) then change the MailTo local variable accordingly. This is what I have done currently to get the functionality.