after a lot of digging, we found that a rule in the firewall caused this. SMTP ALG (Application Layer Gateway) was enabled, and the rule for Anti-SPAM, 'Deny emails with mismatching SMTP command "From" address and email header "From" address' was enabled.