Seems to come from the From email field: https://github.com/PHPMailer/PHPMailer/compare/v5.2.17...v5....

More details here: https://www.saotn.org/exploit-phps-mail-get-remote-code-exec...

PHP mail doc: http://php.net/manual/en/function.mail.php

A function that allows to pass arbitrary flags to a command line, what could go wrong... :)

    mail('[email protected]', 'the subject', 'the message', null, '[email protected]');