you can always find from what IP the mail was sent in the mail header. each MTA appends a line "received: from xxx" to the header. usually there are two such lines. look at the last such line.
note the colon is before "from" for MTA added lines (which cannot be easily forged) and the after "from" for the envelope address.