We had a user's account credentials get compromised, and spammers were able to spend qabout 3 hours spewing through my mail server. I've locked down the account, cleaned up the queue, etc. and am now doing some investigation.

As far as I can tell, my firewall does not permit port 25 access to the Kerio server from the the outside world; it all gets forwarded to our spam filter / server. We do permit 465 through so that mobile devices that can't use ActiveSync will work. Looking at the audit log, I see entries like so:

[22/Mar/2017 15:49:58] SMTP: User j.smith<_at_>example.com authenticated  from IP address 12.34.56.78

Does that mean the authentication was through any SMTP port, or would authentication through secure SMTP (port 465) begin with "SSMTP" or some such? I realize that the compromised password makes the port used practically irrelevant, I'm just curious.