The port will be undefined since it's not a service that's listening on a certain port. It will be assigned a random high port when trying to connect to the remote service. Therefore you cannot just look at the source port. The logger will probably connect to a remote server where the SMTP is running on port 25, but this might also be another port.
An approach to detect unusual streams would be to look at the email streams. Normally all clients in your network should connect to your own mail servers, so when programs start sending email by using another IP than your email server, it might be something fishy. It can of course also be legitimate. Also consider that the keylogger might just log in to your email server with valid credentials and email from there.
Also in your example you say that it requires a username and password, which means it will probably log on to the gmail mail server and send an email from there. This is completely encrypted. This means you need to look at the flows towards google mail servers and ask your employees if they were using gmail or not.
There really isn't a simple way to detect these attacks. The best way would be to use an anti-virus that can detect keyloggers on the machines. Regardless to say that this may be to avail as the machine was probably already compromised and an attacker might have added more than just a keylogger.