These are brief rants. I'll expand on them when I have time to get properly worked up!
Sendmail causes a few problems. In an ideal world, sendmail would deliver mail once per envelope recipient and provide information on the name of the recipient!. That sendmail doesn't do this is pathetic. The name of the misfeature is "Duplicate Suppression".
The code to deal with this nonsense in mdforward is triggered by the variable $sendmail_kludge_mode. Read the source for the contortions involved in this. (Aside: this feature increased the code size by 50%, and testing time by closer to 100%.)
If procmail worked as advertised, mdforward would not be necessary.
In short, procmail is unsuitable for civilized beings to use as:
That last problem is why procmail core dumps now and then. There are a gazillion buffer overflows too; someone with more time than I have will figure out how to exploit one or more as security problems. (Aside: the current procmail maintainer is apparently fixing the buffer overflows. I've not checked.)
The only factor saving procmail from sendmail style security ignominy is that procmail's obvious overflows are in buffers allocated on the heap, and these are harder to exploit than your common or garden stack overflow. (Not being setuid root doesn't count: procmail's installation instructions recommend that it be used as sendmail's local delivery agent.)