I just received an email through another email list. This email was obviously from a real list member based on the headers and content. The strange thing is that the From address shows as the local user who owns the virtual maildirs on my server.

I also noticed that SpamAssassin marked this message with a rule stating that there were no lowercase letters in the From address. But when I look at it, there are only lowercase letters. It seems like Courier rewrote the From address for some reason -- possibly when Maildrop resubmitted the message for delivery to our internal mailserver. Would this happen for an empty From address? Any other reason?

I have this set in my maildroprc for mail delivery (along with a patched deliver.C to enable the -f option):

import SENDER SENDMAIL="/usr/lib/courier/bin/sendmail -f \"$SENDER\""

Is there any case where SENDER would default to the local user for an external email?

This is the only time I have seen this happen, but it is really strange.