I think he said that: The blog owner's email host did not provide SPF protection; the intruder's email host appended some headers that lured Posterous to classify the email as genuine.

So, having access to the blog owner's email headers would not have provided any additional advantage to the intruder.