While troubleshooting this problem, I found that system messages are attempting to deliver to my domain's MX servers. But, for some reason, the connection dies during the SMTP session. Because the cipher is ECDHE, I am unable to decrypt the session in Wireshark. Before getting more fancy with the process, Jereming recommended that I change the SMTP Out binding under Settings>Protocols to use the Internet-facing NIC. Doing so fixed the issue with delivering system messages, but it broke mail flow for gateways on the internal network NIC.
The option at this point was obvious: regular client mail flow trumps system messages, so restoring the SMTP Out to the internal NIC and breaking system messages is the going-forward configuration.
This feature request is under consideration, but more "yes, please," would be helpful. Thus the shameless bump.