When a channel program or the periodic message return job returns messages to both the postmaster and the original sender, the postmaster copy can either be the entire message or just the headers. Restricting the postmaster copy to just the headers adds an additional level of privacy to user mail. However, this by itself does not guarantee message security; postmasters and system managers are typically in a position where the contents of messages can be read using root system privileges, if they so choose.
The keywords postheadonly and postheadbody are used to control what gets sent to the postmaster. postheadbody returns both the headers and the contents of the message. It is the default. postheadonly causes only the headers to be sent to the postmaster.