◇ Could this help me?
Yes. All three points are accurate and commonly missed: origin IPs really do leak through DNS history and mail headers, allowlisting the proxy's IP ranges at the origin firewall is the documented fix, and flexible SSL genuinely leaves the second hop in clear text. The rotation detail worth adding is that the provider's IP ranges change, so the allowlist needs an automated refresh rather than a one-time paste. This is a general practice.
Audit whether this application's origin server can be reached directly, bypassing the edge proxy. Check every subdomain, MX record, and outbound email header for an exposed origin IP, and tell me what DNS history would reveal. Then give me the firewall configuration that allows only the proxy's published IP ranges, including how that allowlist stays current as those ranges change, and the exact steps to move SSL to full strict mode with an origin certificate installed.