I have a guess. I bet that you have a rule, as do I that blocks for failed login attempts someone on their network is failing to authenticate with their third party email client or  smart hone.

 

Search the domain name with related traffic. Start with the SMTP log, but also check POP log and IMAP log. Once the result display click CTRL F5 On the browser and search the page for "too many connections failure" I just start typing "too many" You will see the IP blocked or "authentication failed" Up above that look for the user name and then the EHLO message. That will tell you the machine, in case there are many in the office.