While examining audit logs you discover that people are able to telnet into the SMTP server on port 25 You would like to block this though you do not see any evidence of an attack or other wrong doing