The more pressing question is why plain text authentication, or even a plain text listener was configured to begin with, in 2026 (really, 2016, being generous). STARTTLS is not a valid reason.

I used to host email servers for a university, I'm probably going to have nightmares tonight just because I read this post hah