Ok I went scouring through the logs trying to trace a particular message like you suggested and I did find some like this:
Here's one message I tracked.214CA3AC88D: from=<listname-bounces@domain.com>, size=585098, nrcpt=500 (queue active) then214CA3AC88D: to=<name@otherdomain.com>, relay=none, delay=32256, delays=32255/0.05/0.15/0, dsn=4.4.1, status=deferred (connect to mail1.otherdomain.com[x.x.x.x]:25: Connection refused then214CA3AC88D: from=<listname-bounces@domain.com>, size=585098, nrcpt=500 (queue active) then214CA3AC88D: sender non-delivery notification: 35F9D3AC8A5 then35F9D3AC8A5: from=<>, size=3771, nrcpt=1 (queue active) then35F9D3AC8A5: to=<listname-bounces@domain.com>, relay=hubtransport.domain.net[192.168.0.165]:25, delay=0.22, delays=0.08/0.04/0.01/0.1, dsn=2.6.0, status=sent (250 2.6.0 <20140620091131.35F9D3AC8A5@mail1.domain.com> Queued mail for delivery) then35F9D3AC8A5: removed
First of all, these should be from=<listname-bounces@domain.com>, not from=<listname@domain.com>. If your posts are really being sent with envelope from <listname@domain.com>, that means bounces will be returned as list posts, not as bounces.
But, I'm still not seeing what I need to see. Taking the last above message as an example, do
grep B52323AC87E /var/log/maillog
or whatever the log file is. In the last few lines, you should see one that says
...postfix/bounce[...]: B52323AC87E sender non-delivery notification: xxxx
where xxx is another Postfix queue ID for the bounce DSN. Then grep the log for that Queue ID, and what do you see?
Here's one where it seems to send the bounced message back to ExchangeJun 20 04:11:31 poseidon postfix/smtp[1539]: 35F9D3AC8A5: to=<listname@domain.com>, relay=hubtransport.domain.com[192.168.0.165]:25, delay=0.22, delays=0.08/0.04/0.01/0.1, dsn=2.6.0, status=sent (250 2.6.0 <20140620091131.35F9D3AC8A5@mail1.domain.com> Queued mail for delivery)
If this is actually a report on one of those DSNs, it should be going to=<listname-bounces@domain.com>, not to=<listname@domain.com>. If the envelope from of your outgoing posts is really <listname@domain.com> and not <listname-bounces@domain.com>, that would explain why bounces are being processed and it might explain what the heldmsg files are (i.e. bounces returned to the list and being held as non-member posts).
It this is what's happening, something is rewriting the envelope sender. What, I have no idea.