Check the firewall polices that you have VIPs on that they are only opening up ports need for that traffic and whether NAT is enabled (it shouldn't be unless you have unusual reasons for needing it).
Maybe temporarily disconnect the server in question then see if you can still ping it/checked the IP with openresolver.com. Alternately use nslookup and connect to the IP address to see what info is handed back. Worst case is you have DNS running on an AD server or other internal server that is responding to outside requests to through a NATed firewall policy or VIP.
You could try sniffing the traffic...
diag debug reset
diag debug flow filter addr <IP address>
diag debug flow filter proto 6
diag debug flow filter port 25
diag debug flow show console enable
diag debug flow trace start 1000
diag debug en
Though you really should try to fix/resolve the problem -- a possible workaround is to look into setting up local-in-policy rules.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C