the secure way to get the real ip is to mail all these people asking them to copy/paste you (not forward) the headers of the mail they received
you should see then
Return-Path: <
[email protected] >
Received: from [domain] (IP)
check to whom the IP belongs and contact him,the IP is the open relay the spammer used. The admin of this relay maybe will be able to help you. I still believe it's the 64.252.190.201 but in order to be sure.
Give him the money to make him search for the IP of the sender. I think it will take him long time (if there's such log file)
