Question on the Sober.I worm

I have a client that is receiving all kinds of emails that fit the description of the Sober.I worm. All anti-virus patterns are up to date and I ran the removal tool from Symantec with no virus found. The emails keep coming. Looking at the Internet Header information the originating IP is from a local contact. The contact said the IP is assigned to his group but it is not in use??? Will the worm spoof an IP address as well as the sender?