Morris Dovey wrote:

Examine the headers of the offending message. Many will contain an
e-mail address for reporting abuses.

And many of them are forged. NNTP-Posting-Host is forged less often, but it
is sometimes missing. The Path list is probably the best as long as it
doesn't show "MISMATCH" in it. But IIRC, even it can be forged.

Short answer, it's difficult if not impossible to locate the professional
spammer. What you can do is nab the amateur.

--
It's turtles, all the way down