Thanks for sharing.
I was searching for a solution that does not expose any user email addresses in general.
Although, special categories could be marked for private replies by email and could additionally expose official email addresses, which, in our case, are (or should be) well known by our users.
In that case, it would not be necessary to handle private or confidential information inside Discourse at all.
The more I think about this, the more I like it.
However, unlike your implementation, I would prefer not to change the email template and instead make this work by changing email headers.
I suppose the from address should still be something like do-not-reply@my.discourse to satisfy DMARC. The reply-to: header would be my.name@official.site, and the to: field would include the recipient and the reply-to-forum email address.