Usually, this issue is mainly caused when enabling "Detect new spam sources" option in Content Scanning, then setting up an incorrect list of domain/s. To resolve this issue:

1. Open the SMEX web console.
2. Navigate to Spam Prevention > Content Scanning > New Spam Sources > Detect new spam sources.
   If too many domains are added under "Organizational MX record FQDN(s):", but these domains do not belong to your environment, spam detection will spend more time to check all of these domains. This will then cause an email to be scanned more than X-milliseconds, thus causing the Exchange 1050 warning event to appear.
    

   This is not black or white list. SMEX needs to know one organization's own domain MX records before parsing out the new spam sender's IP address.
3. Ensure to only fill this with the customer's own organizational MX Record/s or mail gateway IP address (domains or IPs that belong to customer's environment).