Don't know exactly since my email server removes virii from emails. It's definitely spoofing email addresses though because I can see from the header it's coming from the the same IP address, but the sender address changes.

Almost all email virii these days are spoofed using addresses stolen from the user's address book.