How to know it was spoofing

The easiest way to identify spoofing is to check the email header of an email. This header is important since it tells you the IP address of the computer that had sent the email. To find the original sender’s IP address is by looking the first line of the Received header (HTTP) . Return-path or Reply-to also stated the originator’s email address. Example shown as below:

From: Media Temple user (mt.kb.user@gmail.com)

Subject: article: How to Trace an Email

Date: January 25, 2011 3:30:58 PM PDT

To: user@example.com

Return-Path: <mt.kb.user@gmail.com>

Envelope-To: user@example.com

Delivery-Date: Tue, 25 Jan 2011 15:31:01 -0700

Received: from po-out-1718.google.com ([72.14.252.155]:54907) by cl35.gs01.gridserver.com with esmtp (Exim 4.63) (envelope-from <mt.kb.user@gmail.com>) id 1KDoNH-0000f0-RL for user@example.com; Tue, 25 Jan 2011 15:31:01 -0700

Received: by po-out-1718.google.com with SMTP id y22so795146pof.4 for <user@example.com>; Tue, 25 Jan 2011 15:30:58 -0700 (PDT)

Received: by 10.141.116.17 with SMTP id t17mr3929916rvm.251.1214951458741; Tue, 25 Jan 2011 15:30:58 -0700 (PDT)

Received: by 10.140.188.3 with HTTP; Tue, 25 Jan 2011 15:30:58 -0700 (PDT)