1) Note, you can patch this in a theme or plugin of your own by explicitly setting a sender email address:

    add_filter("wp_mail_from", function($generated_from) { return "mysender@mydomain.com"; });

2) The thing I'm not understanding - wouldn't setting a "Host:" header change the directory being served in most virtual host configurations? For instance:

    POST /wp/wordpress/wp-login.php?action=lostpassword HTTP/1.1
    Host: injected-attackers-mxserver.com

In most configurations the web server would look for a virtual host configuration matching "injected-attackers-mxserver.com" - and when not found would just return a 404 or error page, or possibly the default Apache/nginx directory? So to be vulnerable the WordPress install would need to be accessible via either A) a default config or B) an IP address.

3) It's odd there isn't a patch for this. WordPress already creates and stores a canonical "siteurl" on install, and this setting is not changed by any "$_SERVER" variable.