On the Incident Form, when a user creates a new Journal > Email, where is the FROM address defined? I'd like to update this so that it selects different values based on Service, but I don't know how this information gets populated.
This should be coming from the Journal.Email Initialization rule named "Initialization Rule for Journal#Email.From Addr".
Currently it is defined to pull the actual listener address which comes from the Email setup for the entire system. You can accomplish alteration of the From address by changing this rule to be similar to the ToAddr rule where it pulls based on object.