Don't use port 25 authenticating. Use the correct secure ports - 465 (and on v11 587 will be available as well)
Have a read around as to why.
So you use smtp2go to send and Hetzner to receive.
It will simplify things for you if ALL your users ONLY connect to your SME server. Do not let them send or receive via the upstream systems - I'd imagine that is where your issues lie.
Then you can change upstream providers whenever you want.
You can also see all connections in and out which will simplify debugging if it still occurs.
BTW is there a way to collect mail from the CATCHALL Account every 3 Minutes instead of the 5 Minute interval?
believe me, you don't want it
UNDERSTOOD
First, a couple of minutes won't make any material difference unless your users are literally glued to their devices every second of the day.
It will probably cause more problems than it solves, especially when someone tries to send you a 200Mb attachment and it clogs up your mail server.
The real solution is to dump the whole POP3 kludge and use your server as a full SMTP server to receive mail, and the clients to use IMAP.
(you can still use an upstream service to send mail - I do that myself)