Any header can be forged in a mail - simply it is not possible to forge all at the same time. I am really surprized that the IP address has been forged, usually only the email addresses are.
As for who did that and/or where, it is impossible to answer without more details. The common way for that kind of investigation is to analyze the full headers and try to establish which MTA were involved. If all are under control (belonging to your organization), you could have more infos from the logs of the first one in the chain.
If all are trustworthy (belong to well know organizations) you could find the IP address of the sender. But in the vast majority of case, you end on various relays and need a legal action to obtain the informations.
Anyway, faking a sender email does not even require the corresponding password...
To directly answer your question, it depends on your knowledge. It you know enough of the SMTP protocol to seriously examine the headers, you may find evidences that the mail has been forged and use them to try to prove that you have not sent them. If you do not and asked for a simple workthrough, I am afraid that no exists and you should first find an expert in SMTP and then eventually a lawyer.