No it's not kickers. That's only what the recipient of the e-mail would see, and even they still get the original sender in the full headers.
Exim stats will tell you who the relayer is, which in the case of mod_php, is always "nobody
{server_name}". With phpsuexec, the relayer will be "{account_name}
{server_name}"
Here's an example of finding out the real sender:
Here's the headers from a Surmunity E-mail. I removed most of it that wasn't important to the point.
Return path will now be the username instead of nobody. And mirror.dizinc.com would receive it from username instead of nobody.
Even though it says From
hellosurmunity.com, it's still sent by
nobodymirror.dizinc.com