Hello,
The default behavior of Exim is to use the cPanel username and hostname of the server to construct the envelope-sender address. Most applications that call the Exim/Sendmail binary will pass the -f switch along with the proper email address to keep that from happening.
If you can configure the mailer to use SMTP and authenticate with SMTP AUTH, this will set the correct "Return-Path" in the headers. The other option is to make sure that the application is using the 5th argument to the PHP mail() function to send the '-f' switch to sendmail so that it sets the correct "Return-Path".
Thank you.