You set it up with your own IMAP(TLS) and smtpd for email, and in your server logs the logins were coming from Samsung IPs, not the wifi or cellular network your phone was connected to? Where were these Samsung IPs in terms of physical location and netblock? If they're doing MITM on their customers' traffic I'm really curious where it's going through.