When sending emails, OpenX does not explicitly set the Return-Path in the mail header. As such it defaults to the user which runs the webserver. This might have some privacy issues.
Easy fix in /lib/OA/Email.php:
In function sendMail() replace
$value = @mail($toParam, $subject, $contents, $headersParam);
$value = @mail($toParam, $subject, $contents, $headersParam, "-r" . $fromDetails['emailAddress']);
By setting the -r parameter, sendmail will set the Return-Path to the sender's email address ( From: ) as defined in OpenX.
Please note that this is just a hotfix. It should be tested that the address in the Return-Path (here: $fromDetails['emailAddress']) always defaults to the AdServer administrator's From: address and not to a client's/agencies email From: address when configuring OpenX with
"Use the owning account's Contact, Email and Name instead of the above Name, Email Address and Company when emailing reports to Advertiser or Website accounts."
i just did not search the sourcecode for any other variable available in EMail.php to take this into account as i do not use this setting.