Yup. They don't look at the From: field, but deeper into the headers of the mail, to see from which IP (numerical) address it came. Every mail has these headers and they say something like: (this computer) sent the mail to (that computer) and it delivered to (third computer) to be delivered to you. these IP addresses can also be faked, but it's not the usual tactics with viruses. Anyway, the From field is not an indicator of who sent the mail at all. You can change it in your program, after all. BTW, your provuder would probably just inform you that you have a virus, if you had it.

-- erlik