Assuming they didn't use an anonymous remailer or just spoof the address, then wading through the headers should be all that's necessary.

If they did any of the above, it's pretty much a lost cause. The amount of effort required wouldn't make it worth it.