Did you received
from the domain lecardinal.de?
I realized that a lot of Spammails use a faked sender in the form firstname.lastname@example.org. I promise these Mail was not sent from this domain. You can simply proof where the Mail came from. Just watch into the header of the email. In most emailclients you have to adjust the view of the mail then you will see a header like this:
The example above is a Spammail. You can see several sections beginning with "Received: from ...". I have placed some Xs to anonymize the original reciepient.
So, how can you recognize if it is Spam or not? It's easy: All messages sent from domain lecardinal.de have one "Received:"-section containing the following string:
You can see the IP 220.127.116.11 which belongs to shadow.prohost.de and you can proof this on http://ip-lookup.net/.
All mails from the domain lecardinal.de are routed over shadow.prohost.de
So, if you see an IP like the one in the first example (18.104.22.168) check it with http://ip-lookup.net/ and you'll see where it came from. In the above case you'll find that the IP belongs to phillips.com and it's clear that Phillips® wont send Spammails but the Spammer could have used a compromised computer in the IP-Range of Phillips®. Sorry, Phillips, for this example.