[Achilles]

That would often be true, but in this case the address belongs to a company offering wireless hotspot connections in Manila. Since they wouldn't be offering an ISP based email to public users the scammer is almost certainly using a web based email provider such as hotmail or gmail etc. This would mean that the x-originating-ip is the actual ip of the machine from which the message is sent. Of course, given that they accessed the internet via a public connection they are essentially untracable. Handy when you are commiting international cheque fraud.