View the Internet Header. Usually an option in the email client to display it.
It'll give you the origin ip address, time, etc...
Problem is if it was sent from a Webmail client and someone did get the kids PW it won't prove or disprove anything.
This is what header info looks like.
Return-Path:
Delivery-Date: Fri, 17 Jun 2005 11:50:08 -0400
Received: from [68.142.201.189] (helo=web31709.mail.mud.yahoo.com)
by mx.perfora.net with ESMTP (Nemesis),
id 0MKuxu-1DjJ6e0U5T-0006tm for scott@stomachmonkeys.com; Fri, 17 Jun 2005 11:50:08 -0400
Received: (qmail 1777 invoked by uid 60001); 17 Jun 2005 15:50:08 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:Received
ate:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding;
b=UWNfS+zhj59B+mUQrSqE6TkaXUhtx+xQ+HOZMN5yC6zjddpA Tc5ixP8v9P5r/lO0mDFdwhcDSIKwZIsHm13hwbP9mpRlPDtIR88yJ6EK9i91UXr 6Hs4vuzd/1GdblwsGQBrFVaX3tPZC61fzJWwpLXt/mJ84o3xa39wFgG5pHn0= ;
Message-ID: <20050617155007.1775.qmail@web31709.mail.mud.yahoo. com>
Received: from [24.47.56.163] by web31709.mail.mud.yahoo.com via HTTP; Fri, 17 Jun 2005 08:50:07 PDT
Date: Fri, 17 Jun 2005 08:50:07 -0700 (PDT)
From: Jordan Stanley
Subject: Re: Daughter
To: Scott Jenkins
In-Reply-To:
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1386602451-1119023407=:1329"
Content-Transfer-Encoding: 8bit
Envelope-To: scott@stomachmonkeys.com