I am trying to trace the origin of an email because the IP address that it shows it originated from is HIGHLY suspicious. (I was not the recipient of the email, it was forwarded to me by someone.
The person who forwarded the email has a strong incentive to make me believe the originating IP address is valid.)

Can the header on a forwarded email be changed to show a different Originating IP address? Is there any way to tell if this has happened?