Cisco's email gateway is under attack. Check the scanner update, then check for compromise.
Cisco has fixed an actively exploited email gateway flaw. A scanner update can close the hole without a restart, but suspected compromise needs a separate response.