Where did this email come from?

[cranebill]

This is what we are trying to figure out...

One of our employees got two emails this morning from an ex employee....

however the email address used is no longer in existance therefore we are trying to see where the email was sent from to see if it may be an internal virus or see if it is just someone spoofing his old email address...

We are using Outlook XP

 

[eyec]

need more info

 

[cranebill]

I learned about header today and now have the ip address....

figured it out...

 

[eyec]

the ip address is not always enough. look for the message id line - that nails it down to the originator.