Morning OP,
It is possible to trace the origin of an email through the IP address that is transmitted along with the message.
If it's Gmail and sent through a web browser, then the IP will only point to a Google server because they hide the originator. But if it's been sent through a smart phone client like Apple email or Outlook etc, then it is still possible to see the IP in the header.
I would get your friend to forward the email on to you and ask your man to have a look and see if the IP is there. Once you have this, you can search it and it should result in giving the approx area of the origin of the message.
To get the IP:
Log into your Gmail account with your username and password.
Open the message to display the email headers, click on the inverted triangle beside the reply tab and select show original.
Look for received: from followed by the IP address between square brackets [ ].
EG: Received: from [12.123.12.1] by yourfriendsemailaddy@herISP
If you find more than one received from patterns, select the last one.
Once you have the IP, do a Net search and see what comes back.
This isn't really going to tell your friend much more than she already knows though - it's likely to be local and someone close to her. It also isn't going to identify the name of the person that sent it.
Personally, I would go for saying nothing at the moment (because you don't want to alert him and then him cover his tracks) and do some more detective work and see what surfaces.
There are, once alerted to suspicious behaviour, lots of things you can do to gather evidence in readyness for the big talk.
The most important thing here though, is patience. Your friend must bury the emotion for now and take her time to look for clues with a clear head......
Best of luck to your friend & hope everything works out OK for her.