Craigslist phishing - email sender breakdown help

[enlong]

Hey, can you guys help me better understand where this email came from?

Received: from dkc8.tomeliotfisch.com ([12.49.219.227]) by col0-mc2-f31.Col0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);

Fri, 13 Aug 2010 13:17:46 -0700

Received: from User ([92.84.225.250]) by dkc8.tomeliotfisch.com with Microsoft SMTPSVC(6.0.3790.4675);

Fri, 13 Aug 2010 13:16:06 -0700

From what I understand, this email originally came from "User" with the ip address 92.84.225.250. An IP check reveals this to be located somewhere in Romania. The server it came from seems to be from tomeliotfisch.com which is an architect website based in San Francisco, CA?

Help, I don't get it. Why is an email from someone in Romania being sent from a domain based on architecture in San Francisco?

When I trace the IP address from the user, it shows it as related to ARtelecom Network Operation Center in Romania. So how does the person sending the email get it to show it being sent from tomeliotfisch.com?:O