I recently noticed an SMTP session on my server which started when a remote host connected but never seemed to result in any emails being delivered. I could see that it was probably a SPAM site and so I killed the SMTP session, but the remote host immediately reconnected but using a different HELO domain.
I was curious what they were doing so I used tcpdump to capture the session and killed it again to capture a session from the start.
What I found was they did:
HELO randomdomain.com RSET AUTH LOGIN
With the RSET and AUTH LOGIN being repeated over and over in a loop.
Does this look like a brute force attack on the passwords?