Alright i was running thru the logs at startup and well i saw this..
Aug 6 22:52:06 Fileserver sSMTP[25629]: Creating SSL connection to host
Aug 6 22:52:07 Fileserver sSMTP[25629]: SSL connection using TLS_AES_256_GCM_SHA384
Aug 6 22:52:14 Fileserver sSMTP[25629]: Authorization failed (535 5.7.139 Authentication unsuccessful, the user credentials were incorrect. [MW4PR03CA0330.namprd03.prod.outlook.com 2024-08-07T05:52:14.004Z 08DCB5C25C35280B]
i'm like WTF is this i have no clues its not my exchange server for sure. seems sus. any ideas here to start to track this down