I was awarded some kind of points, maybe fictitious, on the cPanel forum decades ago because my sig was ‘kill more spammers’.
This might be useful. It uses the destination port and that’s what we are looking for. Not what is coming in on port 25 but what is going out.:
watch -n .1 ss -te 'dport == :25'
the -n .1 us the time basis for which watch renews. You can lengthen this time to try and get more stable output.