Yes, it fakes its source. I got a copy claiming to be from Microsoft itself in the 'From:' line!
Fortunately I have Norton AV and it prevented the thing from being downloaded and activated. Are you reading all of the headers to get this source? You need to dig into other headers than the 'From:' line to find out where it is really coming from.