You have a list of known contacts, initialized from your account page. This is used as the list of mail recipients (in SendMessageFrame) and buff recipients (in SkillBuffFrame). This list is added to when you do a /who in chat, or when send kmail or buff a new player; a new contact in one place is deemed to be be interesting as a new contact in the other.
I think it's reasonable for them to share the same list. I don't know if it's reasonable or unreasonable for selecting a player on one panel to select the same one one the other. I don't understand how it can lead you to "inadvertently" buff the wrong player; when you do to the skill buff frame, does it, or does it not show you the correct name of the victim? If it does not, but casting a skill actually inflicts it upon somebody else, yes, that is a bug. If it does show the correct name and you hit the "cast skill" button, how is that inadvertent? It is doing exactly what you told it to do.