Trying to determine how far down the Received: chain you can trust can
be a real challenge, but there are reasonably good techniques for
doing so.
It is near to impossible one one message alone unless you have the
user configure it for you (not happening for most users)
But it is quite easy on a series of messages.
There are two environments to consider here, first todays level of
spam attack fed largely by organized crime. Second the level that
we are likely to see in a couple of years after the spammers have
been put out of business.
It is pretty easy to design a client that handles well out of the
box for the second environment. In the first environment you are
probably going to end up with quite a few false positives if you
are working at the MUA end alone.