While it is possible (syslog-ng package was installed a week earlier), but let me note that:
1. the log was investigated after <s>user</s> two users had complained. Ignoring this would be inappropriate usage of Ockham's razor.
2. it is not obvious from the first log snippet, but you can actually find logs like
Oct 13 10:47:03 mailsystem postfix/smtp[29587]: 3418D171B96: to=<email address hidden>, orig_to=<email address hidden>, relay=pop3.YYY.ZZ[-----], delay=0,
status=sent (250 Ok: queued as 4EFBD4C53D)
While it is possible (syslog-ng package was installed a week earlier), but let me note that:
1. the log was investigated after <s>user</s> two users had complained. Ignoring this would be inappropriate usage of Ockham's razor.
2. it is not obvious from the first log snippet, but you can actually find logs like
Oct 13 10:47:03 mailsystem postfix/ smtp[29587] : 3418D171B96: to=<email address hidden>, orig_to=<email address hidden>, relay=pop3. YYY.ZZ[ -----], delay=0,
status=sent (250 Ok: queued as 4EFBD4C53D)