There's a bug in latest/current Mail.app (v 16.0) that sends remote HTTP requests for messages under certain circumstances even when "block all remote content" is checked in the privacy tab in settings. Thank fuck for Little Snitch.