News: tracking Summary
Check Path: header for possible open NNTP servers, or obvious non-NNTP hosts. Preferably compare paths obtained from various sources.
Check message-Id, NNTP-Posting-Host, if necessary use logfiles to get exact date+time.
From address can easily be faked.