Identity
P1, P2, From, Reply-To, and Return-Path
Email has more than one sender identity. That is normal. It is also one of the main reasons phishing analysis cannot stop at the visible sender line.
P1 Sender
The P1 sender is the SMTP envelope sender. It is the transport-level sender used during delivery. SPF is generally evaluated against this identity, not the visible From line.
This value often lives in the return path or bounce address.
P2 Recipient
The P2 recipient is the message-level recipient shown in the message headers. The transport envelope can route the message differently behind the scenes, especially in forwarding or mailing-list scenarios.
Visible From
The visible From address is what the user sees in the mail client. DMARC is built around this visible identity because this is what people naturally trust first.
Attackers abuse this constantly by choosing believable display names or domains that look close enough to a real organization to pass a quick glance.
Reply-To
The Reply-To address tells the mail client where a reply should go. A Reply-To that points somewhere unexpected is often a strong phishing clue, especially when it does not line up with the visible sender or the envelope sender.