That is a bad actor on tor, attempting to send  spam email that uses smtp ports to using your tor node as a relay, potentially spoofing the source to make it look like your relay is the sender. be sure to block any and all ports for smtp, 25, 465, 587, 2525 (not a comprehensive list of ports) for both incoming and outgoing connections. Your host, once it appears that your server is sending mass amounts of spam, may suspend or terminate your account. just went through this with hetzner this week.