While I agree that a FSM is what you want and that fully parsing an smtp session is difficult and should be left to the professionals, I think the main thing missing here is keeping track of the RCPT TO addresses and then outputting them where you want them.

I did this with an @rcpts array and appended it after the headers. To do that, you have to keep track of where you are in the conversation so you know when to output the additional headers. Here is a fixed up version that uses your __DATA__

#!/usr/bin/perl
use strict;
use warnings;

my @rcpts        = ();
my @linesBuffer  = ();
my $msgUpdateCnt = 0;

my $state = 'unknown';

while (<DATA>) {
    s/\r?\n//;    # strip newlines, since we don't know if they are ri
+ght

    if ( $state eq 'headers' or $state eq 'body' ) {
        if ( $_ eq '.' ) {    # end of message, reset
            $state = 'unknown';
        }
        elsif ( $state eq 'headers' and $_ eq '' ) {    # end of heade
+rs
            foreach my $rcpt (@rcpts) {
                push @linesBuffer, 'To: ' . $rcpt;
            }
            $state = 'body';
        }
    }

    elsif ( $_ eq 'DATA' ) {
        $state = 'headers';
    }

    elsif (/^RCPT \s+ TO: \s* (.*)$/xms) {
        push @rcpts, $1;
    }

    elsif ( $_ eq 'RSET' or $_ eq 'QUIT' ) {    # end of message
        if (@linesBuffer) {
            print join "\r\n", @linesBuffer, 'QUIT';
            print "\r\n";
            $msgUpdateCnt++;
        }

        # reset
        @linesBuffer = ();
        @rcpts       = ();
        $state       = 'unknown';
        next;
    }

    if ( @linesBuffer || $_ ) {
        push @linesBuffer, $_;
    }
}

if (@linesBuffer) {
    print join "\r\n", @linesBuffer, 'QUIT';
    print "\r\n";
    $msgUpdateCnt++;
}

print "---------------------EQUALS $msgUpdateCnt--------------------\n
+";

__DATA__
[download]