Release : 15.x
In this instance the cause was a memory leak on the downstream device (Ironport) that was causing ever greater delays to accepting messages and resulting in the the upstream MTA to time-out and terminate the connection. DLP showed upstream disconnections although the root of the problem was downstream.
Symptomatic of this was the RequestProcessor log in DLP showing very long average receive times for messages (circa 40 seconds) although detection times were of the order of fractions of a second.
Fixing the memory leak on the downstream device resolved the issue.