I received a spam email which scrambled the typical "to:" and "from:" fields. However, instead of spoofing the "from:" address, which is apparently the more common tactic, since there are articles about it like this one, this message actually did the opposite: it doesn't show my email address in the "To" field. Similar to this question in this community.
Now, this spam email actually provides a link to unsubscribe. However, I don't know immediately which address to provide because I have forwarding set up so that several different email addresses all forward to this Gmail inbox.
My question is: how to interpret all the text that can be found in the email's full header? This is Gmail's guide. It's quite bare. It also links to its Message Header Tool, but that also doesn't help in my situation. This is what the tool shows:
This doesn't help, since the "To:" field points back to the spammer. In the DKIM field, my institution's domain shows up. (I blacked it out just in case, for privacy.) So, okay, I know now that the email has something to do with my institution, but I still have 2 email addresses affiliated with that institution!
I skimmed through the full text of the full header and I think I found it. But does anyone know how to be more sophisticated in interpreting it? For example, I see "Received:" followed by various text listed multiple times.
