Does badmailfrom control file operate on the "From:" header, the"Return-Path" or something else?

The badmailfrom patch looks at the envelope sender address, which will be recorded by your server in the Return-Path: header.

If you are to use the badmailfrom control you might consider using one of the patchs that use regular expressions and also supports RCPT TO filtering etc.