Look
Since it is coming from localhost and showing unauthenticated, it doesn't look like an external attack more likely one of the mail components trying to connect every few seconds.
You might want to check:
Mail server services (Postfix, Dovecot, etc.)
Webmail (Roundcube / RainLoop if installed)
Cron jobs or monitoring scripts
Database credentials in mail server config files