just because an email shows up in your inbox labeled Bill.Smith[at]somehost.com, doesn’t mean that Bill actually had anything to do with it. Read on as we explore how to dig in and see where a suspicious email actually came from.
http://www.howtogeek.com/169539/how-can-i-find-out-where-an-email-really-came-from/