SMTP TLS doesn't and can't validate the certs. It is trivial to MITM it.