Just looking at the message id and return path in the header is not enough, you can fake those.

You need to look at the list of received headers, to check that the message came direct from the sender's server to your (or your ISPs) server.