Sorry for the late answer, but will your SMTP logs show the original IP or the VPS'?
SwissOS
joined 2 years ago
Ok for http trafic, but what about SMTP?
The problem with such a situation is that you have no idea of the origin IP address, as all the requests look like they are coming from your VPS. Did you find a way to restore origin IP in your logs?
Do you use an external DNS when accessing your subdomain? I can only guess that it's the DNS leaking it.