Firewall logs normally log dropped/rejected packets as a standard. You should see e-mails by locking at the Mail logs (assuming it is enabled), or you can monitor /var/log/mail.log to see connections made to your mail server. mail.log will show all connections to ports 25, 587, as well as IMAP and POP connections.