if he uses a virtual machine with an IP hiding tool and sending it
through anonymous services
Let's try to take that apart.
Uses a virtual machine
With a local email server, you won't be able to have your emails delivered in most cases, assuming you are at home you will end up talking to the distant server with your home IP, there's no helping it. It's logged AND it will probably refuse you or try some grey listing tricks to see if you are a legit sending/receiving server or just a fake server put up to be anonymous for a day.
With a distant server, like Google's gmail, this server is responsible to log and know what's going on, it won't let you send emails with fake headers, it can rewrite them in the worst case.
An IP hiding tool
I assume you are talking about TOR, which exit nodes are not known to be legit email servers. Bad idea. If you can bounce on a hacked legit node though, it might work, they will be able to get back to that machine (acting like a SMTP server) though, and from there logs at the network or host level might betray you. If you use TOR + bouncing you are pretty safe I guess, but TOR is not known to be a safe tool for criminal activities or spammers. Multiple bouncing from someone else's WiFi (far away from your usual places, and using an antenna + changing your MAC address and using no facebook/twitter or anything that connects to an account linked to your usual address(es)) can work well. You just need to maintain nodes on which you can bounce, and change your location.
IP are necessary to deliver a message, so except spoofing one node will be revealed, and from that, you should always assume the worst case, where nothing is safe/secure.
The best ways to track down this kind of anonymous mail sender?
If you really want to track people, log everything, use log organizer tools that can let you store, browse and match collected logs), contact the offending IPs managers (whois entry) and tell them that spam came from their IPs, give them all the details you have and if you should ever need to prosecute the responsible spammer/attacker, ask them to come back to you ASAP with what they have. In the worst case they will have nothing...
That's for the pure technological part, you could also see what the emails contain and to who the spoofed email headers are sent to, try to understand the spoofer's motives, check for any link to their websites in the email, going the other way could prove useful, they don't send spoofed emails to say 'BUY STUFF ON AMAZON DUDE ITS AWESOME', but more like 'We lost your credit card number, please input it here: http: / / 42 . 42 . 42 . 42 / hoax.php'.
If you don't want to track them, install grey and black listing tools, monitor them closely at first to check that no legit email is blocked. Then it should get better and better, you can report spammers and get their IPs blocked on global black lists used by everyone.
That's usually the way people (should) do it. You don't want to end up talking to Tunisia about some dude using his neighbor WiFi to send you emails, they won't care, it will take forever and you will get nothing out of it.