You need to look at the message header of an e-mail. In Outlook, you open the message and go to View

ptions. Now, you will see a series of domains and IP addresses. Only thing that is reliable is the IP address in brackets such as [64.78.0.183]. All the other information in the message header can be faked. Now, to figure out the originating e-mail location, you can perform a lookup of the last "Received" line starting from the top. Take that IP address and perform a ping on it. If you can resolve a domain name, try performing an nslookup on that domain. That may provide registrar contact info.
Thanks,
Sun
Received: from ex2.intermedia-inc.net (mail.intermedia.net [64.78.0.183])
by mail.disney.com (Switch-2.0.1/Switch-2.0.1) with ESMTP id eBG07Ut22906