Sorry, you're incorrect: mailing headers which contain hostname/IP address are appended to every piece of email at every hop.
The most you can do here is to use a broken system and insert additional, incorrect information before passing along, but the host involved would have been tagged as broken by most RBLs within minutes.
Which is what most spammers do, hence my statement Spam is almost never traceable, it usually comes from a bunk address Stands...