Watchoutbelow,
When you get one of the emails with the SoBig Virus, expand the header information. Inside there you will find the info on the actual originating email address and IP address. You will notice that it is different from the FROM listed on the standard email header.
Take Care,
Richard