That is correct,
most modern viruses like Klez will fake as much as it can in the header information so you cannot rely on anything in there, not even the routng info until you see your servers.
Remember that these things include thier own SMTP servers so they can fake anything.