backtracking email
Really it's just a matter of looking through the headers and carefully checking the order of the Received: header(s). Usually you figure you can trust your own mailserver, and probably most of the earlier Received: transactions recorded are legit, but in truth there's no reason to know that it wasn't all forged when it got delivered to your mailserver (so the whole trail could be fabricated).