The spam looks like this:
Received: from murch.greatsill.info (HELO find-your-perfect-bride-russians.us) (18.104.22.168)The body text is just HTML:
by [redacted] with SMTP; 8 Aug 2014 00:36:28 -0000
Date: Thu, 07 Aug 2014 17:34:22 -0700
Subject: How are you doing?
From: Stewart [firstname.lastname@example.org]
The originating IP is 22.214.171.124 (Ecatel, Netherlands). The spamvertised site is hosted on 126.96.36.199 (michael.asmallorange.com) although it is currently 403ing.
I don't know the origins of this spam, but it is being investigated.