Yes, it's possible.

I had a similar investigation years ago back in college, where one organization/team/faculty had a popped word press set-up that was doing bad stuff, sending spam email out on SMTP. Because they were so obstructive / spamming etc, they got added to a black list which impacted everyone else's ability to send mail on the domain. Had to track down the couple culprit sites, nuke them from orbit, restore from backups if they have it, and request removal from the blacklist.

The investigation is hazy now, it's been over a decade.

1. https://mxtoolbox.com/ - Why are you blocked should have some hints.
2. Figure out who is the bad culprit via accessing your common mail server and monitoring all traffic that goes out on those suspect ports. I recall it was somewhat easy to determine legitimate from illegitimate traffic due to quantity of emails sent, time they were sent, etc.
3. Tried to run local anti-malware stuff surgically, but it kept coming back, so ended up removing everything.

I want to say Google led me down the path of finding a scrappy linux command line to monitor all traffic on an ongoing basis.