You should look up to MIME data in the emails. This can act as a sort of digital signature and tell you who and from where the email was sent. If she is using POP mail, then this should be pretty strait forward...just find the option to display the MIME data. If she is using outlook, just right click on the email and choose properties, then click the details tab. If she is using some online email service (eg. hotmail) than it might be a bit more difficult. I'm not really sure if you can retrieve the MIME data directly in the web interface of hotmail, but if you access the account with something like outlook, you should be able to get the necessary info. I'm not sure about other web based email services.
As for what you can do with the MIME data, it will probably contain the IP address of the computer that was used to send the email. Unfortunately, there could be a few different IP addresses, so you'll have to sort through which are actaully relavent. Though I guess even if you determine the IP, it may or may not be useful. I guess it's a starting point though...
Sorry I couldn't be of more help.
