Tracking SoBig.F virus senders by IP?

I know that SoBig spoofs the senders email address but does its email engine also spoof or mask the ip number of the originating machine? The AV software on our email server sends me notices of incoming viruses (I am trying to tweak it to delete them) and the info includes an IP number and a message ID number. Since all of the incoming messages for a particular recipient have the same IP number, I was hoping this might give me a way of tracking the source of the message.