Generally spam senders are use group e-mail software, the address of the sender could be fake. The head allows you to find the real sender. To check the letter head as follows:

1) If you’re using web page to check the e-mail, you just open the e-mail directly, click the menu "text" that displayed on the top of the page. So, you could see the letter head.

2)If you’re using Outlook Express, pointing to the email, do not open, click the right mouse button and see the attribute of this e-mail, then click on the details, So you could see the letter head. If there is a sender, behind the sender is the true sender; If not, “received from” is used by the sender SMTP server. 

    The basic expression format of “Receive” is: from Server A by Server B, Server A is the Send server, Server B is receiving server. Such as:

    ReturnPath:

　　Received: from ns.enet.com.cn ([202.106.124.167])

　　by mail.777.net.cn (8.9.3/8.8.7)

　　with SMTP id TAA13043;

　　Thu, 28 Oct 1999 19:51:28 +0800

　　Received: (from list@localhost)

　　by ns.enet.com.cn (8.9.3/8.9.0) id RAA19714

　　for enewsdailylist; Thu, 28 Oct 1999 17:50:30 +0800

　　Received: from chinanetweek.com ([210.72.235.218])

　　by ns.enet.com.cn (8.9.3/8.9.0)

　　with ESMTP id RAA19690

　　for < enewsdaily@enet.com.cn >; Thu, 28 Oct 1999 17:50:28 +0800

　　Received: from chinanetweek.com ([10.1.2.105])

　　by chinanetweek.com (8.9.3/8.9.0)

　　with ESMTP id RAA05935

　　for ; Thu, 28 Oct 1999 17:49:26 +0800

    (CST) Generally the last sentence of the Receive Server A is the sender’s address; Server B is the send server, and also the beginning of the mail. And Server B in the first sentence is receiving Server. The letter head for various servers are different; sometimes you could not find any IP address or domain name of “Receive”. In this situation you just need to ignore and continue to find.