untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ9/BL5Z2N1Vqrq9/VPCrm8vQH/xbQmz0cHARb1rzkdBhQTO8UyTz9kI1WL4il5POleO3os0fnr/Rpp+gClLdJwk=

OpenBSD 6.0 errata 4, Aug 23, 2016:

A missing initialization can prevent mail headers from being altered
as intended, resulting in mail being sent to incorrect addresses.

Apply by doing:
    signify -Vep /etc/signify/openbsd-60-base.pub -x 004_smtpd.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install smtpd:
    cd /usr/src/usr.sbin/smtpd
    make obj
    make depend
    make
    make install

Index: usr.sbin/smtpd/rfc2822.c
===================================================================
RCS file: /cvs/src/usr.sbin/smtpd/rfc2822.c,v
retrieving revision 1.7
diff -u -p -r1.7 rfc2822.c
--- usr.sbin/smtpd/rfc2822.c	4 Feb 2016 22:35:17 -0000	1.7
+++ usr.sbin/smtpd/rfc2822.c	22 Aug 2016 15:23:41 -0000
@@ -138,6 +138,7 @@ rfc2822_parser_init(struct rfc2822_parse
 	TAILQ_INIT(&rp->header.lines);
 	rfc2822_header_default_callback(rp, hdr_dflt_cb, NULL);
 	rfc2822_body_callback(rp, body_dflt_cb, NULL);
+	rfc2822_parser_reset(rp);
 }
 
 void