I first when to ARIN's web page and did a standard whois request off of there. I always start at ARIN because it will at least tell you what Registrar that space is assigned to (whereas the others in my experience don't). It then said the space was registered with RIPE (Reseaux IP Europeens) and issued a standard query based on the IP.

There are other things you can do to modify your query, but the reason I supplied what I did was that it provides who to contact in the ISP from which the email purports to have originated from. That is who your friend would have to contact to track it further (or police or your ISP, depending on how you want to do it...)

/nebulus