I've seen this once when we were sending dkim signed messages to an external company. They had spam filtering software that messed up the dkim header, probably because it was quite long, and all the other headers ended up in the message body. I don't know the name of the software, but it was something running on their exchange server.

So indeed, capture a copy of the message as it is received/sent by the ironport so you know where it gets corrupted.

Go into logconfig and set up injection debug logs for the domain in question - that way you can really tell what is coming into the ironport.

You can also set up domain debug logs for the destination; however, you probably have a lot of mail going to your hosts.

A blank line in the headers can cause what normally looks like headers to end up in the body.