My first thought was that it might be from the originating IP address. But if he used the Gmail website (online client), wouldn't that have been Gmail's SMTP se

My first thought was that it might be from the originating IP address. But if he used the Gmail website (online client), wouldn't that have been Gmail's SMTP server IP? Edit: from this conversation on Stack Exchange[1]: "IIRC, Google never had client IP information in its web mail headers." Maybe he asked a desktop client? [1] https://security.stackexchange.com/questions/238483/is-the-ip-address-of-the-client-present-in-the-email-headers-for-webmail-service https://security.stackexchange.com/questions/238483/is-the-i...