Track real SMTP connections: spamdlogd

emailserver = "192.0.2.225"
pass log proto tcp to $emailserver port $email 
pass log proto tcp from $emailserver to port smtp 

or log to separate pflog interface

pass log (to pflog1) proto tcp to $emailserver port $email
pass log (to pflog1) proto tcp from $emailserver to port smtp