Dynamically specify the 'To' email/recipient using Contact Form plugin
Reading the documentation it sounds like you should be able to specify toEmail using a text input. I'm guessing that it is using the default email because you aren't validating the email address first.

&lt;input type="text" name="toEmail"&gt;

The plugin will get toEmail from the post request and validate it for use.

$toEmail = craft()-&gt;request-&gt;getPost('toEmail');
$toEmail = craft()-&gt;security-&gt;validateData($toEmail);