When an email passes through a Linux-based InterScan Messaging Security product (IMSx) and the "From" (sender) field is blank or incomplete, it gets populated with the FQDN of the IMSx server.
The original from field is blank: Return-Path: <>
The from field will become: From: < Attachment@mail1 .domain.net >
mail1.domain.net - the FQDN of the IMS* server
This behavior is part of the cleanup procedure of Postfix.
If you do not want this behavior to occur on your server, run the following commands in the Linux shell:
postconf -e append_at_myorigin=no
The commands will prevent Postfix from populating the "From" field when it is blank or incomplete.
For more information on Postfix parameters, refer to the following topic: Postfix Configuration Parameters.