You have an email, you check the headers. You get the IP address, you then take out a subpoena and present it to the ISP of the IP address to find out who was connected to the IP at a specific time... right?
What if the email's headers just show the servers IP? Subpoena on the company to request the IP, then the above procedure?
What if you're not residing in the USA? How does a foreign countries law body get the information from the email company? And in what circumstances?
Thanks for your question.
The crime committed in any case would have to be serious enough to warrant a subpoena. So it's not as simple as you describe.
If it happens between countries with varying laws, http://www.interpol.int would have to get involved to work with local authorities from each location.
We're not attorneys here so the best thing to do would be to seek legal advice as I'm sure there's much more involved than what I describe above.