It is not possible to send a real bounce message from a delivered message since bounce messages come from the mail server. It is possible to send something that looks like a bounce message, but is conceptually more like an automated response.

• The SMTP destination address is the SMTP return address. The return address is usually available in the Return-Path header of the delivered message.
• The return address is the empty address; this is so double bounces get delivered to the postmaster of the mail server.
• The To address is the return address.
• The From address is usually MAILER-DAEMON at your domain.
• The format should follow the standard for error messages.
• Optionally, the original mail can be included as an attachment.

Doing all this without modules is hard because you need to parse the message to find the return address, generate the bounce messages possibly with attachments, and do the SMTP transactions.