Almost daily, I receive campaigns of SPAM that are either replications from the same From address, or a litany of SPAM from different From addresses. What I determined is that they were all usually confined to one Return-Path server address. This is not the Reply To information. I was able to add a new Mail header named Return-Path, which I use in a Mail rule to redirect those incoming SPAM emails to the Trash.
I have an AppleScript that when run, prints a dialog showing the Return-Path address, and the From address for a selected email message. I wrote this to automate extracting the Return-Path server address, so I could write an effective Mail rule. It would help you to determine if the SPAM has a common Return-Path server address.