其實，因為信件很可能會經過重重轉寄，所以要追蹤並不容易；
不過哩，還是可以比對一下下，如果多封信都是同一 IP 發出的就比較有可信度了。
大致看一下信件原始標頭，裡面會記錄信件傳遞的過程，但，也有可能是偽造的就是了，如下例！通常來說，發信 IP 就是 Message-ID 的上一行
from okeyxpl (200.84.125-166.dyn.dsl.cantv.net [200.84.125.166] ，此例中的這個 dyn.dsl.cantv.net 顯然是國外來的！
AND... 事出也許有其因，但夫人應該有免於恐懼的權利，個人覺得還是先向電信警察報案後再回頭找原因。
若可以的話不妨把標頭貼出來大家猜猜？
代碼:
Delivered-To:
Received: by 10.150.201.14 with SMTP id y14cs12953ybf;
Tue, 17 Jun 2008 00:07:19 -0700 (PDT)
Received: by 10.110.90.9 with SMTP id n9mr5112692tib.40.1213686437757;
Tue, 17 Jun 2008 00:07:17 -0700 (PDT)
Return-Path: <[email protected]>
Received: from ms6.hinet.net (ms6.hinet.net [168.95.4.60])
by mx.google.com with ESMTP id y5si3535984tia.8.2008.06.17.00.07.15;
Tue, 17 Jun 2008 00:07:17 -0700 (PDT)
Received-SPF: neutral (google.com: 168.95.4.60 is neither permitted nor denied by best guess record for domain of ) client-ip=168.95.4.60;
Authentication-Results: mx.google.com; spf=neutral (google.com: 168.95.4.60 is neither permitted nor denied by best guess record for domain of ) [email protected]
Received: from msx-sms1-5.hinet.net (msx-sms1-5.hinet.net [168.95.7.15])
by ms6.hinet.net (8.8.8/8.8.8) with ESMTP id PAA11077
for <[email protected]>; Tue, 17 Jun 2008 15:07:14 +0800 (CST)
Received: from msx-sg1-1.hinet.net (msx-sg1-1.hinet.net [168.95.5.101])
by msx-sms1-5.hinet.net (8.12.11/8.12.11) with ESMTP id m5H77CUs013019
for <[email protected]>; Tue, 17 Jun 2008 15:07:13 +0800 (CST)
Received: from okeyxpl (200.84.125-166.dyn.dsl.cantv.net [200.84.125.166] (may be forged))
by msx-sg1-1.hinet.net (8.8.8/8.8.8) with SMTP id PAA24966
for <[email protected]>; Tue, 17 Jun 2008 15:07:11 +0800 (CST)
Message-ID: <000901c8d047$89032800$0100007f@uckreb>