The plot thickens, I have now found the entries and yes it seemed to be the server ip listed
Spam cannibal gives this reason for listing:
spam source, anonymous/un-named IP see: 88.208.220.202
Yet that IP is none of mine but another from the same range the hosting company provide to me and they have been no help!
cant find ANY reference to that IP in today's logs
CBL Lookup Utility
Gives me this:
IP Address xx.xxx.xxx.xxx is listed in the CBL. It appears to be infected with a spam sending trojan, proxy or some other form of botnet.
It was last detected at 2014-12-16 11:00 GMT (+/- 30 minutes), approximately 5 hours, 30 minutes ago.
So I have looked through I presume the SMTP log for today from about 10am to 12:30pm
Log has lots of emails being sent to mailboxes as well as aliases, all look like they should in the log in a format I expect.
How on earth are you supposed to tell from that what was the one that got my client listed?
Wish it was easier to find issues like this within SM