Strange Postfix from address when forwarding mail

Background:
I have a users domain (aaaa.com) on a dedicated IP.
User has a webform that emails info to user@aaaa.com. This worked fine on a different server.

When the mail hits "user@aaa.com" mail box we have it setup to put a copy of mail in mailbox for "user@aaa.com" and also forward mail to "allmail@aaa.com."

The customer then pops the mail from allmail@aaa.com and processes with a script.

Here is where the problem comes in, the header information for the email in user@aaa.com and also allmail@aaa.com has a weird from address.
From: john doe <johndoe@hotmail.com>, ")"@s3.aaaa.com
Note the: ")"@s3.aaaa.com

Any suggestions on to solve this problem would be much appreciated.
I checked the following files and didn’t see anything obviously wrong:
/etc/aliases
/etc/postfix/virtual
/etc/postfix/master.cf
/etc/postfix/main.cf
/etc/procmailrc

Sample header follows,
Thanks, Roger

Note: domain bbbb.com is an alias for aaaa.com
so user1@aaaa.com == user1@bbbb.com

Return-Path: <aaaa@s3.aaaa.com>
X-Spam-Checker-Version: SpamAssassin 3.1.9 (2007-02-13) on s3.aaaa.com
X-Spam-Level:
X-Spam-Status: No, score=0.5 required=5.0 tests=FORGED_HOTMAIL_RCVD2,NO_RELAYS
autolearn=no version=3.1.9
X-Original-To: user1@bbbb.com
Delivered-To: allmail.aaaa@s3.aaaa.com
Received: by s3.aaaa.com (Postfix)
id 2BF54905F0F; Wed, 11 Jun 2008 00:02:54 -0700 (PDT)
Delivered-To: user1.aaaa@s3.aaaa.com
Received: by s3.aaaa.com (Postfix, from userid 502)
id 23ED6905F10; Wed, 11 Jun 2008 00:02:54 -0700 (PDT)
To: user1@bbbb.com
From: john doe <johndoe@hotmail.com>, ")"@s3.aaaa.com
Subject: Order Form
Message-Id: <20080611070254.23ED6905F10@s3.aaaa.com>
Date: Wed, 11 Jun 2008 00:02:54 -0700 (PDT)

I’m guessing that is coming from the script that sends the email…perhaps syntax has changed between versions of PHP (or whatever language you’re using to send the mail) on the old server and the new? That looks like maybe you have some sort of function call deciding the address to send to, but it’s picking up the ending paren instead of the result of the function call. I dunno.