If it is the same IP address every time, you can use various methods to resolve that IP to a hostname. For example, you can open up a MS-DOS window (assuming you're using Windows) and type without quotes "tracert xx.xxx.xxx.xxx" where the x's are the numbers of the IP address. If it resolves to a domain you can recognize, then you can use whois as others have described above.
If it isn't the same IP every time, then you've probably got somebody that is using a dialup account....if you're lucky, you can resolve the IP using tracert and then use whois and you can give the ISP a phonecall.

This method works as well as any program you would download, but without the download.

Keep in mind, it could very well be Nimda or another worm like it -- if the host is something like "mail.school.edu" then that's probably what you're dealing with.

Best of luck!