@zappel
Holts euch Samspade von 
http://www.samspade.org/ssw/
den Header ins Clipboard, Spade starten,Strg-v, dann kommt das (nur in Farbe) raus:
==========================================
02/12/02 01:24:24 Input
The Received: headers are the important ones to read
My comments are just hints, and should be considered only
an opinion. I may have guessed wrong, or things may have
changed since I was written
Return-Path: <winkler@terramail.pl>
X-Flags: 0000
Delivered-To: GMX delivery to ...@gmx.at
Received: (qmail 21304 invoked by uid 0); 11 Feb 2002
    20:14:43 -0000
  This received header was added by your mailserver
  Just a qmail status line
Received: from alfa.terramail.pl (213.76.136.82)  by
    mx0.gmx.net (mx022-rz3) with SMTP; 11 Feb 2002 20:14:43
    -0000
  mx0.gmx.net received this from alfa.terramail.pl
  (IP addresses match)
Received: from Fimmjxwf (h062040190146.per.cm.kabsi.at
    [62.40.190.146]) by alfa.terramail.pl (Postfix) with SMTP
    id 6F6DE229F4 for <...@gmx.at>; Mon, 11 Feb 2002 21:14:40
    +0100 (CET)
  alfa.terramail.pl received this from someone claiming
  to be Fimmjxwf
  This doesn't match the IP address in the headers, so this
  may be a relay point. If so all headers below are probably
  forged.
  It really came from h062040190146.per.cm.kabsi.at
==================================================  ==========
Sehr empfehlenswert auch:
[FAQ] E-Mail-Header lesen und verstehen <2001-07-10>
http://www.faqs.org/faqs/de-net-abuse/email-header-faq/
g17