How to determine where the letter came from, by service headers?

Question

PHP

There are email headers:

Delivered-To: [email protected]@external
Return-path: <>
Authentication-Results: emx.mail.ru; spf=none () [email protected] smtp.helo=HJHZ013.steadyhost.ru
Received-SPF: none
Received: from [95.211.18.91] (port=42056 helo=HJHZ013.steadyhost.ru)
by mxpdd3.i.mail.ru with esmtp (envelope-from )
id 1axI8D-0002Kr-I4
for [email protected]; Mon, 02 May 2016 20:59:41 +0300
X-Mru-BL: 0:0
X-Mru-TLS: TLSv1.2:AES256-GCM-SHA384
X-Mru-BadRcptsCount: 0
X-Mru-PTR: HJHZ013 .steadyhost.ru
X-Mru-NR: 1
X-Mru-OF: unknown (unknown)
X-Mru-RC: NL
Received: from [188.165.28.156] (helo=duma.gov.ru)
by HJHZ013.steadyhost. en with ESMTP (envelope-from )
id 1axIC0-0007ri-ML
for [email protected]; Mon, 02 May 2016 18:03:36 +0000
Date: Mon, 02 May 2016 14:03:33 -0400
Message-ID: <[email protected]>
From: [email protected]
To: [email protected]
Subject:=?windows-1251?B?z/Dl5PPv8OXm5OXt6OUg5Ov/IFNreW5lcw==?=
Content-Type: text/plain; charset=windows-1251
X-DMARC-Policy: no
X-Mras: OK
X-Mru-Authenticated-Sender: [email protected]
X-Spam: undefined

Where exactly is the true address for sending the letter written?
Ps mailing was carried out by scammers

Answer 1

Well, I see it like this:
188.165.28.156 sending HELO duma.gov.ru sends a letter to hjhz013.steadyhost.ru
95.211.18.91 sending HELO steadyhost.ru sends a letter to mxpdd.i.mail.ru
The fact that scammers is understandable :)