Well it seems you've done your homework and it's probably a senderbase error.  The first thought that came to mind was some kind of virus or spyware on the server dumping out messages that SmarterMail wouldn't know about, but if sysmon shows that only SmarterMail is using port 25 then that's probably not the case unless someone has come up with a way to hide that activity.  

 

I'd mark it up to a senderbase issue.  It's also possible that some third party is spoofing your IP Address, but if they're doing that there's not much you can do about it.

 

-Joe

 

Senderbase conglomerates data from it's users/partners based upon headers for received emails. We have had an IP in one of our Class C CIDR ranges that is definitely not in use (for the past 5 or 6 years now...it was previously assigned to a co-lo server we hosted) show activity for 5 days every month for the past year and tore our hair out checking, double-checking, triple-checking every possibility. Turns out it is an IP that is being used by Spoofed Spam in forged headers. Since there is no rDNS for this IP most recipients should be rejecting it, so it doesn't hurt us any...but it did waste 40 or so hours of spare time trying to track it down on our side before we were confident it absolutely-positively wasn't actually coming from us.

Moral of the story: Senderbase isn't always accurate. I check our ranges weekly for any abnormalities, just to be sure, but if there is an abnormality and you can't find the source on your network and your bandwidth monitors aren't showing corresponding outbound activity, then don't lose any sleep over it.

40+ hours is not "spare time!"