Here you can see the header of the first email, written by 'prof Patrick Johnson'.

Return-Path: <johnson_p2002@hotmail.com>
Delivered-To: 7-cynthia@heathernova.info
Received: (qmail 6116 invoked from network); 22 Jan 2006 10:04:39 -0000
Received: from unknown (HELO hotmail552.com) (83.110.178.9)
by wpc0134.amenworld.com with SMTP; 22 Jan 2006 10:04:39 -0000
From: Prof Patrick Johnson <johnson_p2002@hotmail.com>
To: cynthia@heathernova.info
Reply-To: johnson_p2002@hotmail.com
Subject: Special Invitation
Date: Mon, 23 Jan 2006 14:06:14 +0400
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="a050d74e-a0eb-40e1-8475-51bd32d5bce8"

Here you can see the header of the second email, written by 'the organization'


Return-Path: <info@ncards.org>
Delivered-To: 7-cynthia@heathernova.info
Received: (qmail 32068 invoked from network); 25 Jan 2006 11:14:13 -0000
Received: from 82.70-84-33.reverse.theplanet.com (HELO company.mail) (70.84.33.82)
by wpc0134.amenworld.com with SMTP; 25 Jan 2006 11:14:13 -0000
Received: from WorldClient by company.mail
(MDaemon.PRO.v8.0.2.R)
with ESMTP id md50000066740.msg
for <cynthia@heathernova.info>; Wed, 25 Jan 2006 16:44:12 +0530
Received: from [213.42.2.21] via WorldClient with HTTP;
Wed, 25 Jan 2006 16:44:09 +0530
Date: Wed, 25 Jan 2006 16:44:09 +0530
From: "info" <info@ncards.org>
To: "cynthia fridsma" <cynthia@heathernova.info>
Subject: Re: Special Invitation
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="_0125-1644-09-PART-BREAK"
Message-ID: <WorldClient-F200601251644.AA44090354@ncards.org>
X-Mailer: WorldClient 8.0.2
In-Reply-To: <43D7D1F3.3070905@heathernova.info>
References: <43D7D1F3.3070905@heathernova.info>
X-Authenticated-Sender: info@ncards.org
X-Spam-Processed: company.mail, Wed, 25 Jan 2006 16:44:12 +0530
(not processed: message from valid local sender)
X-Return-Path: info@ncards.org
X-MDaemon-Deliver-To: cynthia@heathernova.info
X-MDAV-Processed: company.mail, Wed, 25 Jan 2006 16:44:13 +0530


Here you can see the header of the third email, written by 'the organization'

Return-Path: <info@ncards.org>
Delivered-To: 7-cynthia@heathernova.info
Received: (qmail 14695 invoked from network); 31 Jan 2006 16:32:57 -0000
Received: from 82.70-84-33.reverse.theplanet.com (HELO company.mail) (70.84.33.82)
by wpc0134.amenworld.com with SMTP; 31 Jan 2006 16:32:57 -0000
Received: from WorldClient by company.mail
(MDaemon.PRO.v8.0.2.R)
with ESMTP id md50000094288.msg
for <cynthia@heathernova.info>; Tue, 31 Jan 2006 22:02:56 +0530
Received: from [195.229.241.180] via WorldClient with HTTP;
Tue, 31 Jan 2006 22:02:54 +0530
Date: Tue, 31 Jan 2006 22:02:54 +0530
From: "info" <info@ncards.org>
To: "cynthia fridsma" <cynthia@heathernova.info>
Subject: FILE NUMBER
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0131-2202-54-PART-BREAK"
Message-ID: <WorldClient-F200601312202.AA02540076@ncards.org>
X-Mailer: WorldClient 8.0.2
In-Reply-To: <43E002CE.1010203@heathernova.info>
References: <43D7D1F3.3070905@heathernova.info> <WorldClient-F200601251644.AA44090354@ncards.org> <43E002CE.1010203@heathernova.info>
X-Authenticated-Sender: info@ncards.org
X-Spam-Processed: company.mail, Tue, 31 Jan 2006 22:02:56 +0530
(not processed: message size (370447) exceeds max size (51200))
X-Return-Path: info@ncards.org
X-MDaemon-Deliver-To: cynthia@heathernova.info
X-MDAV-Processed: company.mail, Tue, 31 Jan 2006 22:02:56 +0530

Well at least they are using the same ip address : 70.84.33.82

Here you can see the header of the 4th email, written by 'the orgnization'

Return-Path: <info@ncards.org>
Delivered-To: 7-cynthia@heathernova.info
Received: (qmail 14695 invoked from network); 31 Jan 2006 16:32:57 -0000
Received: from 82.70-84-33.reverse.theplanet.com (HELO company.mail) (70.84.33.82)
by wpc0134.amenworld.com with SMTP; 31 Jan 2006 16:32:57 -0000
Received: from WorldClient by company.mail
(MDaemon.PRO.v8.0.2.R)
with ESMTP id md50000094288.msg
for <cynthia@heathernova.info>; Tue, 31 Jan 2006 22:02:56 +0530
Received: from [195.229.241.180] via WorldClient with HTTP;
Tue, 31 Jan 2006 22:02:54 +0530
Date: Tue, 31 Jan 2006 22:02:54 +0530
From: "info" <info@ncards.org>
To: "cynthia fridsma" <cynthia@heathernova.info>
Subject: FILE NUMBER
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0131-2202-54-PART-BREAK"
Message-ID: <WorldClient-F200601312202.AA02540076@ncards.org>
X-Mailer: WorldClient 8.0.2
In-Reply-To: <43E002CE.1010203@heathernova.info>
References: <43D7D1F3.3070905@heathernova.info> <WorldClient-F200601251644.AA44090354@ncards.org> <43E002CE.1010203@heathernova.info>
X-Authenticated-Sender: info@ncards.org
X-Spam-Processed: company.mail, Tue, 31 Jan 2006 22:02:56 +0530
(not processed: message size (370447) exceeds max size (51200))
X-Return-Path: info@ncards.org
X-MDaemon-Deliver-To: cynthia@heathernova.info
X-MDAV-Processed: company.mail, Tue, 31 Jan 2006 22:02:56 +0530

The header from the email of the 'hotel'

Return-Path: <info@hotellenovetel.com>
Delivered-To: 7-cynthia@heathernova.info
Received: (qmail 15539 invoked from network); 31 Jan 2006 17:42:51 -0000
Received: from 82.70-84-33.reverse.theplanet.com (HELO company.mail) (70.84.33.82)
by wpc0134.amenworld.com with SMTP; 31 Jan 2006 17:42:51 -0000
Received: from WorldClient by company.mail
(MDaemon.PRO.v8.0.2.R)
with ESMTP id md50000094425.msg
for <cynthia@heathernova.info>; Tue, 31 Jan 2006 23:12:48 +0530
Received: from [213.42.2.25] via WorldClient with HTTP;
Tue, 31 Jan 2006 23:12:47 +0530
Date: Tue, 31 Jan 2006 23:12:47 +0530
From: "info" <info@hotellenovetel.com>
To: "Cynthia Fridsma" <cynthia@heathernova.info>
Subject: CONTACT US FOR YOUR RESERVATION
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="_0131-2312-47-PART-BREAK"
Message-ID: <WorldClient-F200601312312.AA12470081@hotellenovetel.com>
X-Mailer: WorldClient 8.0.2
In-Reply-To: <1138726834.43df97b2a9a5a@webmail.heathernova.info>
References: <1138726834.43df97b2a9a5a@webmail.heathernova.info>
X-Authenticated-Sender: info@hotellenovetel.com
X-Spam-Processed: company.mail, Tue, 31 Jan 2006 23:12:48 +0530
(not processed: message from valid local sender)
X-Return-Path: info@hotellenovetel.com
X-MDaemon-Deliver-To: cynthia@heathernova.info
X-MDAV-Processed: company.mail, Tue, 31 Jan 2006 23:12:50 +0530

Weird that they have the same Ip address as the 'organization'. How come...
the ip addres is : 70.84.33.82