I'm reporting this mainly to hear from other devs. I found opac-sendbasket.pl is the only place Koha sets that header, and a search tells me it is not standard and is used with several (other) names. In my opinion, such custom header should be configurable, or totally handled in the MTA. And if it was something that should be configurable or even mandatory, shouldn't it be set for all emails? At Koha::Email?
It looks like it was introduced with bug 3280
Yes, I would move it to Koha::Email, add it to all the emails we sent, and rename it X-Report-Abuse-To (looks like the more widely used).
It looks like we are on longer setting this header, so closing this bug.