If the user sends e-mail via an e-mail client to the SMTP server, the presence and content of these headers is controlled by /usr/lib/postfix/kolab_smtp_access_policy which is configured in /etc/kolab/kolab.conf. Reading the source code of the former, I found that X-Authenticated-As: is only being added if an encryption key sender_header_enc_key is set in the kolab.conf. Setting this also avoids setting Sender: and X-Sender: headers (Off-topic: which contained the kolab user name in my case instead of the primary e-mail address). So now I have