UPDATE IV: After a crash course in tracing email headers and IP addresses and the like
. . .
All three of those sets of emails came from the same IP address — 10.70.20.11 — as the original email I received today, so clearly that is an IP address used by the U.S. military in Iraq.
Ladies and Gentlemen of the alleged jury, it appears that some education is in order. Whenever you see an IP address that starts with “10.”, “172.16.” through “172.31.”, “169.254″, or “192.168″, it is the rough equivalent of a “555″ telephone number. These ranges of addresses are set aside for local networks. They cannot be assigned to servers on the Internet, and properly-configured Internet routers will refuse to send traffic to them.
An email that comes from a 10. address is prima facie fake.
UPDATE 1: (heh)
This is not to state that the message itself is necessarily fake, only that the 10. address itself is not "on the Internet". Validation of the author is purported to be done by that machine with the 10. address, which may be valid within a local network, but cannot be verified outside that network. This part of the message is assumed to have been placed there by the next machine above it, which is the one to point to when establishing its validity.
In fact, the validity "chain" must always begin at the top of the headers, for it establishes a nested "Computer A says " Computer B says "Computer C says ... "person X says "..."...""" statement. If Computer A is lying, it doesn't matter whether Computer B is truthful or not, because it never said the rest of the statement. What does make the 10. address special is that it is entirely a creation of the local network administrators, so there is no mechanism to contact it directly to validate that part of the chain of custody.
In that respect, perhaps it's better to say that a 10. address is like a sock puppet.