Mike Wertheim writes:
Here are the log lines that correspond to the emails to the "-leave" address in /var/log/mailman3/smtp.log... [Irrelevant text elided] The IP address is 127.0.0.1. Would that imply that the messages were really sent from the localhost, or could that mean that the real sender IP address just wasn't captured for some reason?
The sender at 127.0.0.1 is your MTA (Postfix, Exim, Sendmail etc). Mailman delegates all Internet functionality to software designed for the purpose, and just accepts everything the MTA sends to Mailman via LMTP. Mailman's "smtp.log" is for Mailman's builtin LMTP server, and doesn't know anything about external connections.
To find out the last hop source IP for the message, you need to look at the MTA's log.
Steve