If Cases are sending an auto-response from a User that isn't defined as the Sent From (Email) in any of your rule entries, the auto-response may be coming from the "Default Response Template" setting.
Classic Steps to Check Default Response TemplateClassic Steps:
Under Setup | Customize | Self-Service | Web-to-Case | Modify | Default Response Template
OR
Under Setup | Customize | Leads | Web-to-Lead | Default Response Template
Lightning Steps to Check Default Response TemplateLightning Steps:
Setup | Feature Settings | Marketing | Web-to-Lead OR Setup | Feature Settings | Service | Web-to-Case
Which says: "Use Case/Lead Auto-Response Rules to select different email response templates based on attributes of the cases/leads submitted online. Cases/Leads not matching any of the rules will be sent the default response template selected below."
This template will be sent from the User triggering the auto-response rule.
If a Case is created online, goes through auto-response rule entries, and doesn't meet criteria on any entry, then the Default Response Template is sent from the current User.
This behavior occurs because the Default Response Template is sent from the currently logged-in user when no auto-response rule entry criteria are met. Identifying and removing or replacing this default template resolves the issue.
To stop auto-response emails from being sent by an unexpected user, remove the Default Response Template if no default response is required. If a default response is still needed, assign a dedicated email address to a service account and ensure that account is used consistently.
Steps:
1. Navigate to the Default Response Template setting
(Classic: Setup > Self-Service > Web-to-Case or Leads > Web-to-Lead;
Lightning: Setup > Feature Settings > Service > Web-to-Case or Marketing > Web-to-Lead).
2. Clear the Default Response Template field if no fallback response is needed.
3. Click Save.
See Also:
Guidelines for Setting Up Web-to-Lead
Set Up Web-to-Case
000384427

We use three kinds of cookies on our websites: required, functional, and advertising. You can choose whether functional and advertising cookies apply. Click on the different cookie categories to find out more about each category and to change the default settings.
Privacy Statement
Required cookies are necessary for basic website functionality. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies.
Functional cookies enhance functions, performance, and services on the website. Some examples include: cookies used to analyze site traffic, cookies used for market research, and cookies used to display advertising that is not directed to a particular individual.
Advertising cookies track activity across websites in order to understand a viewer’s interests, and direct them specific marketing. Some examples include: cookies used for remarketing, or interest-based advertising.