The behaviour you observe is by design, and documented.  The email package needs to be able to handle RFC-invalid input, which includes messages with multiple instances of fields that are supposed to be singletons.  It also needs to keep track of the order of headers.  Thus its interface is, as documented, a "mapping-like" interface with duplicable keys and an element order.

That said, it would be a valid feature request to have a way to have it generate errors if a field that is supposed to be a singleton per-RFC is added more than once.  This will require a registry of such headers...a registry of headers is planned for the next version of the email package (email6), so that would be an appropriate time for this to be implemented.  email6 will also have strict and lenient modes, which will also be useful in this context.