Track Real SMTP Connections: spamdlogd

emailserver = "192.0.2.225"
pass log proto tcp to $emailserver port $email 
pass log proto tcp from $emailserver to port smtp 

or log to separate pflog interface

pass log (to pflog1) proto tcp to $emailserver port $email
pass log (to pflog1) proto tcp from $emailserver to port smtp

Note: 4.7/4.8 log bug for NAT