The qmail-maxrcpth.patch patch allows you to set a limit on how many recipients are specified for any one email message. RFC 2821 section 4.5.3.1 says that an MTA MUST allow at least 100 recipients for each message, but MAY elect not to allow any more than that. I choose not to, since this is one of the favourite tricks of the spammer.
To set the limit, create a /var/qmail/control/maxrcpt file which contains the maximum number of recipients you wish to allow. If you don't want any limit...