Where does drupal_mail() get the return-path and sender?
drupal_mail() gets the value for those headers either from the the value of the site_mail persistent variable (set in admin/config/system/site-information), or from the sendmail_from setting found in php.ini.

The first line of drupal_email() show exactly how the default value for the sender is set.

$default_from = variable_get('site_mail', ini_get('sendmail_from'));


This is then the code that sets the email headers.

  if ($default_from) {

    // To prevent e-mail from looking like spam, the addresses in the Sender and
    // Return-Path headers should have a domain authorized to use the originating
    // SMTP server.
    $headers['From'] = $headers['Sender'] = $headers['Return-Path'] = $default_from;
  }
  if ($from) {
    $headers['From'] = $from;
  }
  $message['headers'] = $headers;