服务器是不是被入侵了？

freefall12

今天看邮件日志发现过去几天反复出现下面的记录

Aug 12 14:19:54 www31225ue postfix/smtp[30049]: connect to klls.com[208.87.35.103]:25: Connection refused
Aug 12 14:19:54 www31225ue postfix/smtp[30047]: connect to klls.com[208.87.35.103]:25: Connection refused
Aug 12 14:19:54 www31225ue postfix/smtp[30048]: connect to klls.com[208.87.35.103]:25: Connection refused
Aug 12 14:19:54 www31225ue postfix/smtp[30049]: BC99C40859: to=<lkeopfrkqoe@klls.com>, relay=none, delay=155339, delays=155338/0.09/0.8/0, dsn=4.4.1, status=deferred (connect to klls.com[208.87.35.103]:25: Connection refused)
Aug 12 14:19:54 www31225ue postfix/smtp[30047]: DF2CC408FC: to=<lkeopfrkqoe@klls.com>, relay=none, delay=155339, delays=155338/0.04/0.92/0, dsn=4.4.1, status=deferred (connect to klls.com[208.87.35.103]:25: Connection refused)

这个好像是有程序在向klls.com发送邮件，但是对方25端口却是关闭的。搞不明白是怎么回事，高人指点一下。