I believe you've found the reason for the forwarding. Exchange considers one address to be canonical for users, and that's the Reply address, the bolded one in the list. Attempts to use other addresses will get rewritten to be the Reply address.
There is one instance where this will NOT happen, though. If you have an Edge server, and configure that Edge server to allow relays from your local LAN, people can use Thunderbird to send email through that Edge server using the non-canonical address. They'll still fetch it from the Client Access server as normal, but the SMTP server needs to be an Edge server that allows email relaying from their IP.