Winsock seems to be using new ports when under load

Hi,

we've got a reasonably busy server that's running a number of internet based
applications. One of which is our (SMTP) mail server.

We've been noticing that every now and then, when an external mail server
connects, our mail server is responding on a port other than 25.

e.g.

smtp.example.com port 1234 -> smtp.ourdomain.com 25 SYN
smtp.ourdomain.com 1028 -> smtp.example.com port 1234 SYN-ACK

The mail software vendor, swears that they're just making standard winsock
calls, with no attempts to change ports
..
The box is Win2k with ISA2k also installed.

Has anyone else seen this kind of behaviour?

Thanks
Craig