I've noticed in 9.5.1 that in the Message Audit Logs the "Sender" query doesn't actually use the FROM header, it uses the RETURN-PATH header. I have to imagine this is a bug? Thanks
Can you provide some evidence of this behaviour?