Or they’re using TOR to mask their actual ISP.
Well, if odds are that this is a spoofed address in Italy, we can consider this to be a relatively sophisticated spammer, not some hack. Even if it is truly from a European, the disinformation is worrying.