you may be right Greg Taylor - EXCHANGE. it was just one block. back in Dec the banhammer came down and we were getting blocks every 5mins. We have an old SQL CLR that runs on a 5min trigger that access a pop3 mailbox and reads the email and then stores the data into a DB. In December we did go through the process of allowing Basic Auth thru.
In our case the source is SQL in a VM in Azure. I would have suggested that Microsoft allows basic auth from trusted IPs. In our case we would have been able to limit basic auth from one dedicated IP in Azure. This would have been a better workaround as companies code around old processes that do not support modern auth. Plus, is would have dramatically reduced the ability for bad actors to do Drive by sprays.
We know MS is bringing the banhammer down for good soon...