It's not just in the source, I totally overlooked the fact the real email address is shown as sender. Lol.

> Does the initial sender matter? Like if it’s the HME address that sends first and receives the reply? I have around 180 of these addresses.

Appears so. Here is exactly what I did:

1. Created the HME through mail, sending to other email service address (OMA). (This disclosed the information in my original comment.)

2. Did some reply ping pong. (No additional disclosure.)

3. Send a new email from OMA to above HME.

4. Replied from iOS mail client (Shown as reusing HME alias.)

5. Received at OMA, the real address is disclosed.

6. On the iOS client side, the mail shows up as sent from the real mail address, too.

Not sure if 1. for HME creation is required, you can likely skip straight to 3. for any HME address.

Funny enough, I observed 6. in the wild before, but was kinda hoping that's an artifact of forwarding a copy of the mail to the thread. I tested this some, but not this particular ping-pong. So yeah... I now gonna check where I evidently leaked my real mail address already...