The extra ones are probably made up by the spammer trying to trick Google's anti spam machinery.

When I was an anti-spam engineer 10 years ago, we saw this sort of tricks all the time. Basically the only headers you can trust are the ones inserted by your own infrastructure. DKIM does mitigate this somewhat, but of course has its own problems.

>Gmail will put messages from you in the Sent folder (label) even when they are sent from outside Gmail.

On the principle of least surprise, this would seem to be incomplete behavior. I bet every single person reading this was surprised.

It's not a bad place to put such mail, so I suggest that on its web and mobile interface, Gmail simply put some kind of badge for sent mail sent from outside Gmail or your devices. Example:

https://imgur.com/a/KEMf1HM

(Notice the ⓘ [circled i] in the first line.)

Source: I mocked above up from Google image search for "gmail sent folder" and an open clipart "information icon".

If you click on that i or hover it should mention that some of these messages were sent from outside Gmail or from your authorized devices but have been put in your Sent folder because your email address is in the from: field.

The last Received: and Received-SPF: headers are forged. It's pretty common for spammers to do that, apparently in an attempt to "trick" either spam filtering software or a person looking at the headers.