May 2 08:00:23 custornwi postfix/smtpd[824]: lost connection after UNKNOWN from unknown[206.168.34.187]
May 2 08:00:23 custornwi postfix/smtpd[824]: disconnect from unknown[206.168.34.187] unknown=0/1 commands=0/1
May 2 08:00:24 custornwi postfix/smtpd[824]: warning: hostname unused-space.coop.net does not resolve to address 206.168.34.187: Name or service not known
May 2 08:00:24 custornwi postfix/smtpd[824]: connect from unknown[206.168.34.187]
May 2 08:00:24 custornwi postfix/smtpd[824]: lost connection after UNKNOWN from unknown[206.168.34.187]
May 2 08:00:24 custornwi postfix/smtpd[824]: disconnect from unknown[206.168.34.187] unknown=0/1 commands=0/1
May 2 08:03:44 custornwi postfix/anvil[826]: statistics: max connection rate 5/60s for (smtp:206.168.34.187) at May 2 08:00:24
May 2 08:03:44 custornwi postfix/anvil[826]: statistics: max connection count 1 for (smtp:206.168.34.187) at May 2 08:00:17
May 2 08:03:44 custornwi postfix/anvil[826]: statistics: max cache size 1 at May 2 08:00:17
May 2 08:06:26 custornwi dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=69.164.217.74, lip=5.104.75.191, session=<6i5BZ3IX6KlFpNlK>
May 2 08:38:12 custornwi dovecot: pop3-login: Disconnected: Too many bad commands (no auth attempts in 0 secs): user=<>, rip=185.167.96.138, lip=5.104.75.191, session=
May 2 08:40:18 custornwi dovecot: imap-login: Disconnected (no auth attempts in 10 secs): user=<>, rip=162.243.135.36, lip=5.104.75.191, TLS handshaking: SSL_accept() syscall failed: Success, session=
May 2 08:40:25 custornwir\ dovecot: imap-login: Disconnected (no auth attempts in 10 secs): user=<>, rip=185.242.226.23, lip=5.104.75.191, TLS handshaking: SSL_accept() syscall failed: Success, session=<yH/F4HIXLrW58uIX>
May 2 08:42:30 custornwi dovecot: pop3-login: Disconnected (no auth attempts in 10 secs): user=<>, rip=107.170.248.43, lip=5.104.75.191, TLS handshaking: SSL_accept() syscall failed: Success, session=<y7E+6HIXYL5rqvgr>
May 2 08:45:41 custornwi dovecot: imap-login: Disconnected (no auth attempts in 4 secs): user=<>, rip=172.104.238.162, lip=5.104.75.191, TLS handshaking: SSL_accept() syscall failed: Success, session=
are any of these logins you trying to login from thunderbird or just attempted connections from randoms ? I looked at the IP addresses in your posted log and they all appear to be on a blocklist.