No auth smtp server sounds like a very bad idea and the real culprit here. Security by obscurity (VPN in this case) never works.