[Exim] undesirable header encapsulation in a pipe transport

I have two servers running Exim 3.36 and 3.35 on Debian/GNU/Linux/x86
with inbound traffic diverted through the spam assassin client and
a message filter that diverts tagged messages to a different mailstore.

Other than differences due to the two domains, as far as I can tell,
the two configurations are identical. However, the slightly older
version is pushing incoming headers into the message body in the pipe.

[Header includes the line]
Received: from mail by server with spam-scanned (Exim 3.35 #1 (Debian))
[Body includes the line]
Received: from originator by server with smtp (Exim 3.35 #1 (Debian))

I don't recall the other server doing that, even when it ran 3.35,
and I've no idea what configuration element could be causing it.
I'd appreciate any suggestions on places to track this oddity down.

The relevant transport and director look like this:

spamcheck:
         driver = pipe
         command = /usr/sbin/exim -d -oMr spam-scanned -bS
         transport_filter = /usr/bin/spamc -u \
                 ${lookup{$local_part}lsearch{/etc/exim/spam-aliases}\
                                 {$value}{spam}}
         bsmtp = one
         home_directory = "/tmp"
         current_directory = "/tmp"
         user = mail
         group = mail
         return_path_add = false
         log_output = true
         return_fail_output = true
         prefix =
         suffix =

spamcheck_director:
    no_verify
    condition = "${if and { {!def:h_X-Spam-Flag:} \
        {!eq {$received_protocol}{spam-scanned}} \
        {!eq {$received_protocol}{local}} } {1}{0}}"
    driver = smartuser
    transport = spamcheck