You need to watch the email headers and look for the originating IP. Then you'll see if the presumed FROM address is what it says. If it's an spoofed email, se

You need to watch the email headers and look for the originating IP. Then you'll see if the presumed FROM address is what it says. If it's an spoofed email, send an abuse report to the owner of that originating IP [+], including full headers and full body text. [+] If the originating IP is from a country you know it won't give a shit, look for the next jump.