Ok, I think I found it. Line 155 of admin/dosendemail.php has a query that looks like this:

Code
select  t2.USER_REAL_EMAIL     
from    {$config['TABLE_PREFIX']}USERS as t1,
{$config['TABLE_PREFIX']}USER_PROFILE as t2,
{$config['TABLE_PREFIX']}USER_DATA as t3
where   t1.USER_ID <> '1'
and     t1.USER_ID = t2.USER_ID                    
and     t1.USER_ID = t3.USER_ID
$removed $sterms

That needs to be:

Code
select  t2.USER_REAL_EMAIL     
from    {$config['TABLE_PREFIX']}USERS as t1,
{$config['TABLE_PREFIX']}USER_PROFILE as t2,
{$config['TABLE_PREFIX']}USER_DATA as t3,
{$config['TABLE_PREFIX']}USER_GROUPS as t4
where   t1.USER_ID <> '1'
and     t1.USER_ID = t2.USER_ID                    
and     t1.USER_ID = t3.USER_ID
and     t1.USER_ID = t4.USER_ID
$removed $sterms