I have spent several hours battling this one and ended up reading the source and stepping through with the debugger. I finally found that I could force MIME::Lite to change the envelope from by forcing the sendmail options in "send":
$mail->send("sendmail", "/usr/sbin/sendmail -t -oi -oem -f security\@auckland.ac.nz");
So far as I can see there is something fundamentally broken in the code that passes the options specified in new through to sendmail