| The thing I don't understand is: why does this only happen if procmail
| processes the message? If I disable procmail, the messages do not have any
| inserted lines.
As others have said, perhaps procmail is escaping an untrusted From_ line.
Another way it could happen is that your .procmailrc has a filter through
formail that spots something before the first blank line that isn't valid in
the header, so it inserts a blank line before it to start the body there.
Procmail alone would not do that (at least it doesn't for me under 3.11pre7).