This was something new to me:
If an original call arrives and 3cx uses the default settings, The called number is guessed from the to:user part. Correct.
However if a diverted call arrives, this header contains the number which was originally called. This is nice, but will identify the called...