I have found that some of these low-frequency error messages

Last error: 551 we do not relay

for hi-volume lists are a result of email addresses RFC821 RCPT TO:<>
that happen to use the lower-preference (higher number) MX RR when that
email address has multiple MX hosts.

Sometimes things are further obfuscated when that email address also
refers to a CNAME record.  This seems to "confuse" SENDMAIL anit-relay
configs.

Thus, when a VM/CMS SMTP client is involved, SMTP re-writes the RCPT TO:
address to the CNAME address, and the secondard SENDMAIL gets the
delivery, the above error occurs.

Or so it seems to be from a recent PSID effort.

/Pete