How is SSH reaching my email server?

Hi all,

We run an email server behind a firewall using NAT to forward all email traffic through the firewall device to the server. Our MX record on the web shows the web ip address of the firewall. When I want to SSH to the email server from outside, I VPN into the firewall then establish a SSH connection to the email server.

Checking the secure log on the email server I see repeated attempts at SSH connections which fail. But I don't see any logs on the firewall that show a VPN connection or any SSH connection. So my questions:

1. How is this happening?

2. Should I be concerned?

3. What am I missing? - I assume a lot, no expert here, just running a small office.

Any input is appreciated. Thanks.