The M'sian email address used by viruses/spammers doesn't mean it must be sent via the M'sian IP lo.

It could be just the text value of the email address used for display and sent out from other countries.