fake emails

short answer - you can't
Current viruses, worms and trojans usually use "real" email addresses, but not the addresses they were sent from - so you can't isolate an infected machine purely from email address, or block based on "false" email source (and to add insult, it usually picks the "from" address from the same place as the "to" - so given how webs of contacts tend to work, it will tend to come from a "known" email address too.
Just like spam, a good filter will block most of it - most AVs have the ability to act as an inline filter, but in that case you will still get the email (just without the infectious attachment) but until we have source-verification for email (not this year, maybe next if you are lucky) anyone can send any email from any place and have it get there....