e-mail trace

a couple nights ago, two of my friends got really drunk and decided to write an e-mail to his girlfriend and the guy she was having an affair with. to make this easier, guy 1(one of my friends) wrote an e-mail to guy 2(guy the girlfriend is cheating on guy 1 with) they created a hotmail account in the now ex-girlfriend’s name with the e-mail address being an insulting phrase written in spanish. they then wrote a somewhat threatening e-mail to the girl and guy 2, in which guy 1’s friend said that while guy 1 wouldn’t be stupid enough to do anything, he may not be. e-mail continued on to say all this random stuff, brought up some personal and embarassing things, made some general threats, etc. they then sent out a couple more to her friends bad mouthing her, all while extremely drunk none the less. because they set up the e-mail account in her name and never included personal information about themselves, could the e-mail be traced back to them at all? while they aren’t going to do anything to guy 2 and just wanted to mess with him, could they end up in more trouble then they bargained for?

Yes, it could, if law-enforcement gets involved. The originator IP address that appears in the Hotmail email header can be traced back to the sender’s ISP, which in turn, can trace back to the sender’s true IP address, and therefore the sender’s identity (on file with the sender’s ISP from when they signed up).

While I’m not 100% sure on this…I believe that an e-mail can not necessarily be traced to a specific person, but can be traced to the IP address of the computer that sent it. So if you used your home computer to send the e-mail…the trace would go back to your home address.

But again…I not 100% sure.

Actually, since Hotmail is web based, wouldn’t the originator IP be the Hotmail server’s IP address? I would imagine that you’d need a court order to have Microsoft release the IP address used to either send the email or register the account, and another court order to have the ISP release the identity of the sender.

Nope. Here’s a sample header (slightly altered) from an email sent from my Hotmail account to my ISP email address:

Return-Path: <myhotmail@hotmail.com>
Received: from hotmail.com ([64.4.19.72]) by mta0XX.verizon.net
(InterMail vM.5.01.05.33 201-253-122-126-133-20030313) with ESMTP
id <20030424062145.VRHK27928.mta0XX.verizon.net@hotmail.com>
for <myispemail@verizon.net>; Thu, 24 Apr 2003 01:21:45 -0500

I have Verizon DSL, hence the verizon.net IP address.