In my mind, I figured that an attacker would sidestep binding to L3 at all, and would just craft raw L2 packets that contain TCP headers with src_addr of every possible address in the subnet. But that too would require elevated privileges, so point taken.

That said, using most of the same general scenario where S is blitheringly unsecured against internal threats -- under the false pretense that NAT somehow provides security -- a DNS rebinding attack that uses an unwitting user's web browser to proxy Mallory's traffic to S could succeed. Maybe not SSH per-se, but any internal service that S is hosting would be vulnerable.

This isn't an attack that's per-se exacerbated by NAT, but a good-and-proper firewall config at the network and on S would easily protect against this, which is why I mention it. If NAT is believed to be "security", then almost certainly the firewall configuration will be overlooked and attack vectors will be left open.