Gather every piece of email correspondence from the mother and son.
Back them up, and print hard copies with headers included. Below is an example of the headers in the email I received from the forum when new posts were made. You want ALL the header information not just the TO: and FROM:
Provide this info to your lawyer. They will contact the internet providers and request email server logs if they're available. Even knowing the date and time the email was sent, and the IP it was sent from in the headers will strengthen the case. If they retain their logs long enough, you may be able to find exact records of the email transactions between servers. Most ISPs dump the logs after a short period of time because of space issues but you may get lucky.
Since the mother and son probably haven't thought their whole scam through, the original email may still be on their computers as well. Make sure your lawyer and the investigating officers are aware of this as well.
Properly presented, email is VERY compelling evidence.
SAMPLE HEADER BEGINS
-------------------------------
From - Wed Mar 31 17:33:34 2004
X-UIDL: f245586a4b47fa85b0103f7c795c56f6
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <sender@blah.com>
X-Original-To:
me@crosswinds.net
Delivered-To:
me@crosswinds.net
Received: from localhost (mx2.crosswinds.net [216.18.117.46])
by maildrop.crosswinds.net (Postfix) with ESMTP id 75F0512D
for <me@crosswinds.net>; Wed, 31 Mar 2004 17:24:03 -0500 (EST)
Received: from mx2.crosswinds.net ([127.0.0.1])
by localhost (mx2.crosswinds.net [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 51927-13 for <me@crosswinds.net>;
Wed, 31 Mar 2004 17:24:00 -0500 (EST)
Received: from home.fdns01.com (home.fdns01.com [63.247.72.226])
by mx2.crosswinds.net (Postfix) with ESMTP id 070E2B4002
for <me@crosswinds.net>; Wed, 31 Mar 2004 17:24:00 -0500 (EST)
Received: from nobody by home.fdns01.com with local (Exim 4.24)
id 1B8o7L-0000fz-NB
for
me@crosswinds.net; Wed, 31 Mar 2004 17:23:27 -0500
To:
me@crosswinds.net
Subject: Reply to post 'Please read: Pending Lawsuit from Venomous Snake Bite'
From: " FaunaClassifieds Forums Mailer" <sender@blahblah.com>
Message-Id: <E1B8o7L-0000fz-NB@home.fdns01.com>
Date: Wed, 31 Mar 2004 17:23:27 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - home.fdns01.com
X-AntiAbuse: Original Domain - crosswinds.net
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - faunaclassifieds.com
X-Virus-Scanned: by amavisd-new at crosswinds.net