Poco Reading FAQ - Determing the originating address for junk mail

Q: I have some email (spam) that I received. The "From" address is obviously faked, how can I determining who sent it?
 
A:
You need to look at the full headers, in particular it's the ip address listed in the last "Received" header that is of interest.

The "DisplayOriginatingIPAddress" script can be used to display this for you. It can be downloaded from the registered users area.

The script examines the "Received" headers of a message and takes the 1st string bracketed by square brackets from the last received header to contain such a string and reports it. This method isn't fool proof as some spam generating programs fake this information as well.