Not sure this is entirely true. RFC 3848 (http://www.rfc-base.org/txt/rfc-3834.txt) covers the implementation detail, and a lot of consideration was given to the prevention of email loops.

Section 4 states that auto-responders should send the response to the email address given by the Return-Path header (usually set to a VERP address for identification of bounces) or if absent then fall back to the email address given in the From header.