I was looking at the view source feature in chrome in the WHMCS mass mail tool. I found this:
<input type="hidden" name="massmailquery" value="SELECT id,id AS userid,tblclients.firstname,tblclients.lastname,tblclients.email FROM tblclients WHERE id!='' AND tblclients.status IN...