Find out where a mail comes from

[christophh]

Hello,
on our Zimbra Server, I´ve sometimes deferred mails.
When I look at this mails, they are from an external IP Adress, and look like spam a bit.
Where can I see, in which way the IP authenticated to send Mails to external Domains?
In generell, the server is no open relay, only a few internal IP´s are allowed to relay without authentication.
Here a Screenshot:


Regards,
Christoph