Have you checked the email in raw form? Most email clients allow you to inspect these email headers. Track back from the email body to the first ip address you get then `whois` that to find where it has come from.