Technically there's not a 100% safe way to do this, but you should be able to just add a comma between email addresses (mailto:babs@example.com,jonathan@example.com?subject=...). If it is to always be the same you might instead want to use a more supported field like cc or bcc (mailto:babs@example.com?cc=jonathan@example.com&subject=...).
Use %0A for a newline:
win = window.location.href = "mailto:"+ mailto + "?cc=jonathan@example.com?subject=report&body=" + "Thought 1" + x + "%0A" + "Thought 2" + y + "%0A" + "Thought 3" + z