Well, each side seems to say it's the other side's issue.. lol.
expanded logs given to me by server team:
2018-10-31 14:54:54.936192500 starting delivery 137872: msg 18483362 to remote help@plomvakc.on.spiceworks.com
2018-10-31 14:54:54.936194500 status: local 0/40 remote 1/60
2018-10-31 14:54:55.383160500 delivery 137872: deferral: 167.89.118.48_does_not_like_recipient./Remote_host_said:_454_4.7.1_<help@swincapsula.on.spiceworks.com>:_Relay_access_denied/Giving_up_on_167.89.118.48./
Your server tried to inject a message to help@plomvakc.on.spiceworks.com which their server rejected as "relay access denied". So their server, 167.89.118.48, AKA mx.sendgrid.net, is not configured to accept mail for plomvakc.on.spiceworks.com. That's problem one. The second is that their mail server has rewritten the envelope to address help@swincapsula.on.spiceworks.com which is included in the rejection message. We can't tell from the outside whether their mail server rewrote the address before checking local delivery domains or after.
In both cases, it is their problem. SME server looked up the MX record for plomvakc.on.spiceworks.com, got mx.sendgrid.net, looked up the IP address of mx.sendgrid.net, connected to the mail server, and tried to deliver the message.
FWIW, they seem to have fixed the problem now:
-bash-3.00$ telnet mx.sendgrid.net 25
Trying 167.89.118.48...
Connected to mx.sendgrid.net.
Escape character is '^]'.
220 mx0036p1las1.sendgrid.net ESMTP Postfix
ehlo charliebrady.org
250-mx0036p1las1.sendgrid.net
250-PIPELINING
250-SIZE 204800000
250-VRFY
250-ETRN
250-STARTTLS
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
mail from: <charlieb@charliebrady.org>
250 2.1.0 Ok
rcpt to: <help@plomvakc.on.spiceworks.com>
250 2.1.5 Ok