$ ldd /usr/sbin/sendmail.sendmail | grep wrap libwrap.so.0 => /usr/lib/libwrap.so.0 (0x00319000)
tcp_wrappers never sees the connection directly. sendmail handles it from start to end.
Thanks for this info. I will set up an iptables rule to block this access.