The extra ones are probably made up by the spammer trying to trick Google's anti spam machinery. When I was an anti-spam engineer 10 years ago, we saw this sor

The extra ones are probably made up by the spammer trying to trick Google's anti spam machinery. When I was an anti-spam engineer 10 years ago, we saw this sort of tricks all the time. Basically the only headers you can trust are the ones inserted by your own infrastructure. DKIM does mitigate this somewhat, but of course has its own problems.