Wants to find out how someone is sending ad emails

I have a friend who works for a large multi thousand user company and who has been receiving unsolicited emails on/off for the last 3 months from 3rd party web based companies, e.g magazine subscription offers, insurance quotes, auto quotes, free sample offers, etc. My friend complained to his IT dept and they asked him for a list of names of people that he thinks don’t like him and said something to him about using IP addresses to find the person (they think it is somebody who works in that company-some of the email offers have his name and work address and work phone no.) who is having the unsolicited emails sent to him.

How easy would it be for the IT dept to track the person who has been requesting the offers be emailed to him? I know little about such matters that IT is throwing around but am curious to understand how this works. Any understanding will be appreciated. My friend says he is on a WAN/LAN. Thanks.

Well they pretty much determined that the information came directly from web sites of 3rd party vendors, advertisers, marketeers, etc and nothing was sent to this worker directly by another worker. Basically someone requested information online posing as this person and it was sent to this workers email address. The person posing as this worker was another coworker who most likely went web surfing at the place they work and filled in forms at various and sundry websites requesting that the info be mailed to the unsuspecting employee. Wonder how many web sites offering adverts etc check IP addys and then forward them on to the recipient?
Can the Admins trace the requestor if the requestor filled in the online forms and then dispatched the requests from the same network that the recipient was on? Thank you for your expertise.

How would the admins try to trace one employee using another employees business info and sending such requests for info from within the same LAN if the admins dont even know who/when another employee might have done that? Wouldnt that be a monumental and doubtful search? (not to mention the man hours involved). Can an IP addy be "stolen" and used to make it look like another used that IP addy to mask the thief? Are there any web sites that talk about this type of data logging for security purposes? Thank you.