Os e-mails são enviados por meio de um protocolo chamado SMTP (Simple Mail Transfer Protocol), no cabeçalho do protocolo supramencionado existe um parâmetro "Received" onde é armazenado os IPs dos servidores que "rotearam" a mensagem, por exemplo:
* from shemp.ufrgs.br (shemp.ufrgs.br [143.54.100.75]) by mail.dc.ufscar.br (Postfix) with ESMTP id 8FD3D2F994; Thu, 15 Jun 2006 17:52:49 -0300 (BRT)
* from localhost (localhost.localdomain [127.0.0.1]) by shemp.ufrgs.br (Postfix) with ESMTP id B2AD357AEB; Thu, 15 Jun 2006 17:52:45 -0300 (BRT)
* from shemp.ufrgs.br ([127.0.0.1]) by localhost (shemp.ufrgs.br [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 12394-01-48; Thu, 15 Jun 2006 17:52:45 -0300 (BRT)
* from peri.ufrgs.br (peri.ufrgs.br [143.54.100.89]) by shemp.ufrgs.br (Postfix) with ESMTP id 71A0657B1A; Thu, 15 Jun 2006 17:51:40 -0300 (BRT)
* from peri.ufrgs.br (localhost.localdomain [127.0.0.1]) by peri.ufrgs.br (Postfix) with ESMTP id 8F9B09FFD6; Thu, 15 Jun 2006 17:51:18 -0300 (BRT)
* from curly.ufrgs.br (curly.ufrgs.br [143.54.1.48]) by peri.ufrgs.br (Postfix) with ESMTP id 9BE3D9FFB5 for
; Thu, 15 Jun 2006 17:51:15 -0300 (BRT)
* from localhost (localhost.localdomain [127.0.0.1]) by curly.ufrgs.br (Postfix) with ESMTP id 329F0EB415 for ; Thu, 15 Jun 2006 17:50:00 -0300 (BRT)
* from curly.ufrgs.br ([127.0.0.1]) by localhost (curly.ufrgs.br [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 09119-01-4 for ; Thu, 15 Jun 2006 17:49:59 -0300 (BRT)
* from shemp.ufrgs.br (shemp.ufrgs.br [143.54.100.75]) by curly.ufrgs.br (Postfix) with ESMTP id 2B7ABEB412 for ; Thu, 15 Jun 2006 17:49:58 -0300 (BRT)
* from localhost (localhost.localdomain [127.0.0.1]) by shemp.ufrgs.br (Postfix) with ESMTP id 403BA57AA5 for ; Thu, 15 Jun 2006 17:51:33 -0300 (BRT)
* from shemp.ufrgs.br ([127.0.0.1]) by localhost (shemp.ufrgs.br [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 12394-01-29 for ; Thu, 15 Jun 2006 17:51:33 -0300 (BRT)
* from wx-out-0102.google.com (wx-out-0102.google.com [66.249.82.205]) by shemp.ufrgs.br (Postfix) with ESMTP id 790F357ACB for ; Thu, 15 Jun 2006 17:51:29 -0300 (BRT)
* by wx-out-0102.google.com with SMTP id s15so121119wxc for ; Thu, 15 Jun 2006 13:51:27 -0700 (PDT)
* by 10.70.126.15 with SMTP id y15mr2836259wxc; Thu, 15 Jun 2006 13:51:27 -0700 (PDT)
* by 10.70.67.4 with HTTP; Thu, 15 Jun 2006 13:51:27 -0700 (PDT)
Com isso você pode saber o IP do servidor SMTP que enviou a mensagem para você.