The exchange mail server has several services running to enable it do its job. There are many ways to deploy an email server solution, whether single stand-alone, cluster, frontend, backend, etc

One crucial service is the SMTP that enables you to send and receive emails to other email servers

If this is stopped then you won’t be able to send or receive emails to the outside world, and if your email clients are configured as exchange mails server clients, then they’ll be able to send within the server but not outside

In our world of massive kind of attacks, there is one kind which is worm email mass attack, where a workstation is processing emails in a mass amount, this can be monitored and blocked

So having this control rule on an email server can have devastating effects because although the email server sending and receiving of large amount of emails is legitimate, the behaviour of this is considered abnormal and thus blocked and you’ll see that the SMTP service will stop and fail to start

Check the anti-virus application you have and see if you have any control rules and if you are able to momentarily disable it, the SMTP won’t start right away, it’ll take time and bear in mind if you are using an Anti-virus management application for your network, then also keep in mind that what you define manually on the client station will be over-written by the policies pushed from that management application over a specified time periods. So once this rule is disable the SMTP will start and after polling policies from the management application it’ll stop again, never ending cycle, so this has to managed by creating separate policies

Having a rule blocking port 25 for mass emails doesn’t necessarily mean that all clients who are under this policy won’t be able to send emails. We do have applications where you configure your mail server, port, account to send for example daily reports. It is sending a number of reports per day, so this isn’t considered a peculiar behaviour but if that workstation is infected with some kind of emailing worm and starts shooting away large amount of emails then this behaviour will be stopped

One more, trust your instincts. If something was working and then not working, then 90% the latest updates/additions you made is causing the problem. If I can I would go HUG my supervisor ;D -sorry about disturbing you on your time off-