Confirmation receipt sent from strange sender address
It looks like you've discovered a bug!  I'm sorry this happened to you, but identifying this helps to make the software better.

I confirmed this bug, and also confirmed that it's not limited to the mail() setting.  I've opened an issue on the CiviCRM issue tracker.

UPDATE: I decided to dig into this a little bit to see if the fix was easy, and it wasn't too bad.  It's available for review now.  If you could apply the fix and let folks know on Github how it works for you, that would be great!  If you're not sure how to apply the fix, get in touch with me on https://chat.civicrm.org, my name there is @junglebird.