1. Open up Mozilla Thunderbird and double click on the hoax message to open it as normal
    Opening up the email

  2. Click on the the View button on the Toolbar, then select [Message Source] as below:

    Opening up the message source

  3. This will display the full headers. Highlight them as shown in the screenshot below in order to copy the text.

    Full headers button shown activated

    You can now paste this information into a new email and send it to phishing@it.ox.ac.uk