My first thought was that it might be from the originating IP address. But if he used the Gmail website (online client), wouldn't that have been Gmail's SMTP server IP?
Edit: from this conversation on Stack Exchange[1]: "IIRC, Google never had client IP information in its web mail headers."
Edit: from this conversation on Stack Exchange[1]: "IIRC, Google never had client IP information in its web mail headers."
Maybe he asked a desktop client?
[1] https://security.stackexchange.com/questions/238483/is-the-i...