Oh ya, their email also hinted that if I change sendmail to send to their smarthost via auth/encrypted port 587, that I might be subject to less stringent rulesets. I guess that makes sense, a zombie bot on a Windbloze box would send on 25, and probably not have creds for 587.
Now to see if sendmail can smarthost to a auth'd 587... m4 here I come...
New motto: sendmail: if you can config it, you can config anything