Just FYI, malicious programs can and do modify the source / destination port / ip of packets. They won't necessarily be able to trick smart SPI on routers (unless the routers are infected), but they can sometimes evade simple firewall rules by changing IP headers or TCP headers in the case of ports.
As to your question -- malware authors would consider a server of any sort (especially a mail server) to be a more valuable prize than a simple workstation. This is because servers are inherently given greater trust in the network than a client endpoint. Infecting only a mail server software by itself is not all that useful, but you can also tweak the firewall settings and send copies of all the organization's email traffic (inbound and outbound) by infecting a server.
If their goal is just to send emails, then sure, the easiest way is to piggy back on the user's existing mail sending routines, and the mail server will be none the wiser unless it spots spam-ish words in the outgoing email and snags it.
If they want to not only send emails but be privy to private communications within the organization, then they'd infect a mail server.
The reason they might have done up their own embedded SMTP server (on a workstation, I'm assuming) is that you're not then beholden to the outgoing mail spam filters of the downstream SMTP server. As a malware author you don't want to rely on bypassing legitimacy checks, you want to route around them entirely. Of course, many routers are configured to block mail protocols such as Exchange and SMTP on all routes except to the certified mail server, to prevent exactly this type of exploit.
- Is there some part of the email system im missing that makes this impossible, and I'm barking up the wrong tree?
Sending mail "as" the authorized user using the user's own account credentials isn't impossible, but for certain clients it can be quite difficult to do it undetected if the client is resistant to automation such as Outlook. You also then need to write software for each particular mail client and try to anticipate and evade potential issues that might trigger pop-up dialogs letting the user know of a potential problem, etc.
I don't think you're barking up the wrong tree, but implementing a micro-smtp server in your malware is going to be more likely to succeed, unless there are routing rules set up to block it (which there aren't in many networks, including yours apparently).
- If I am right, and it was a 'Fake Email Server' sending out those emails, would there be any problems that arise from me blocking all traffic through the firewall that has a DESTINATION port for email traffic that doesn't originate from the server?
This won't be a problem, but it won't make you secure, either.
To be totally secure, you need to null route all traffic on all endpoints by default, and force all clients to use an HTTP proxy that inspects all the traffic and "understands" HTTP (as well as either a well-maintained blacklist, or whitelist of allowed sites).
The reason why simply writing a routing rule for the SMTP port won't work is that they might just use other ports for malicious activity.