Root cause found, marking this resolved.
Confirmed via packet capture (tcpdump on ports 25/587/465) that the emails were genuinely reaching my Mac’s real system Postfix, headers showed Received: by MBPMarceida2026.webdados (Postfix, from userid 501) with X-Mailer: PHPMailer 7.1.1.
Turns out this wasn’t a Local bug. The actual cause: I had an AI coding assistant (Claude Code) running wp-cli commands against the site in a separate terminal session, outside Local’s own site shell. Because of that, wp/php resolved to my system’s Homebrew PHP install instead of Local’s bundled PHP.
Every check I ran inside Local’s site shell (wp eval 'var_dump(ini_get("sendmail_path"))') correctly showed Mailpit’s wrapper, which is why this was so confusing for a while. But that override only applies to Local’s own bundled PHP and its own php.ini. Homebrew’s separate PHP install has its own php.ini, with sendmail_path commented out:
ini
;sendmail_path =
A commented-out sendmail_path makes PHP fall back to its compiled-in default on macOS, /usr/sbin/sendmail -t -i, real system sendmail, completely bypassing Mailpit. So any wp-cli/PHP command run outside Local’s shell context was silently handing mail straight to system Postfix, which then delivered it directly to Google (hitting our own real inbox and triggering G Suite rate-limit alerts on hundreds of stale WooCommerce test emails).
Fix: set an explicit sendmail_path in Homebrew PHP’s ini (/opt/homebrew/etc/php/8.5/php.ini):
ini
sendmail_path = /usr/bin/true
This makes any tool using system PHP no-op on mail instead of falling back to real sendmail, regardless of which shell or tool invokes it.
Takeaway for anyone else hitting this: Local’s Mailpit interception is scoped to Local’s own PHP/shell environment. If you (or any automation/AI tooling) run wp-cli or PHP scripts against a Local site from outside Local’s site shell, you’re using your system’s PHP, and its own mail config, not Local’s. Worth checking which php / php -i | grep sendmail_path for your system PHP install if you ever see mail escaping unexpectedly.
Thanks for the pointers earlier, checking the mail headers and testing with plugins/tools isolated is what eventually led to this.