view the headers of the email addresses and find the originating source ip address where the mail was sent from, i.e the crooks ip address.. do a whois lookup on this ip address to see which company this ip address belongs to.. if its an isp, your lawyer needs to get the isp to hand over the account details of the person who had that ip address assigned to them at that time the email was sent.. this will be the closest you will get to these crooks..