in the config email page, I tested against the LOGIN method, and was able to send an email. I then saved this config.
when I tried sending a test email to a contact, it failed.
after a bit of digging, I found that when the config email page sent a test email, it authenticated with both LOGIN and PLAIN (and uses whichever works). This gave the impression that the selected auth method (LOGIN) works, even if it was actually PLAIN that worked.