Well, the X-Envelope-To: header is used by MercuryD so that's probably where I would start looking. If you have the disk space you could switch on session logging and see it it happens again.

I occasionally receive a message from Mercury that only contains the following two lines:

Received: from spooler by localdomain.com (Mercury/32 v4.80.149); 21 May 2018 08:03:24 -0400
X-Envelope-To: sales@localdomain.com

Anyone know what causes this?

I thought I had posted this inquiry a couple of days ago but never saw it on the forum so my apology if it ends up being a duplicate.

We should probably first identify the source. Was the message received via MercuryD from a POP3 account? 

I don't know how to tell.  The two lines I provided make up the entire content of the .CNM.