When sendmail bounces a mail message, it does so using DSN (T=). The type of address and the actual address of the final original recipient are reported in the bounce message:

Final-Recipient: RFC822; nosuchuser@site.com

This Final-Recipient line shows the type of address (here RFC822) and the actual address (here nosuchuser@site.com) of the final recipient.

Beginning with V8.10, sendmail composes this address expression only once (when the message is queued) and stores it in case the message bounces. The text following the Final-Recipient: is stored in the r line in the qf file, and looks like this:

rRFC822; nosuchuser@site.com

Note that sendmail performs no checks on the text following the r. This means that invalid DSN information placed there will become the text that follows the Final-Recipient: in the bounce message.