Snort SMTP expn-root

[jox () SAFELITE COM (Oxenreider, Jeff)]

Last night at around 7pm EST I got these two log entries from my IDS server.

Jul  5 19:06:33 IDS snort[340]: IDS31/SMTP-expn-root: 207.126.127.68:53244
-> XXX.XXX.XXX.10:25
Jul  5 19:06:33 IDS snort[340]: IDS31/SMTP-expn-root: 207.126.127.68:53244
-> XXX.XXX.XXX.10:25

Weird thing is that originating IP address is "lists.securityfocus.com".
I've been on these lists for over a month and this is the first time I've
ever seen this message come up in my IDS.

Anyone know why this may occur that I'm missing?

Jeffrey A. Oxenreider
Network Security Analyst
Safelite Glass Corp