How can I allow users to send private messages without revealing sender's address?
The 7.x-1.x branch of Private Message has this setting in the PM Email Notify submodule. When enabled, there is a E-mail notify tab on the settings page (/admin/config/messaging/privatemsg) that allows you to configure the email's from header.



By default, if this is blank, it will use the site's default system email. It sounds like the module is configured with another token that's referencing the sender's init email.