The "envelope-to" is not in the header reliably anywhere. It's in the envelope. If you can't get an envelope-to out-of-band somehow, then you cannot complete your task reliably, and you'll need to back up a step to figure out how to do it instead.

This is why I hacked sendmail so that envelope-to was available to my .procmailrc as $1. It shows up under Joey Pruett's name because he was the one that submitted the modifications to the sendmail crew.

-- Randal L. Schwartz, Perl hacker