6. is a sign of bad UX but not leakage to the recipient.

That's what I thought, but I happens to coincide with the actual leakage, so....

What is bad UX is the fact there are two reply buttons in the iOS client. One "in" the mail and one for the thread. The mail one pretends to reply from HME alias, the thread one does not. This alone could expose you by accident, since anyone would expect to reply with HME in any case, but you get exposed either way.