We have found the issue .
another instance of the VM was running in our cloud servers, it was a stuff mistake , he cloned our VM instead of a client VM , for this reason the cloned VM send email from our server (as smtp) so it exist entry in the mail log and no entry in blesta .
for the suspension, as the invoice is paid and closed in our server, but not in the cloned one they was suspended in the cloned one .
SO Sorry for this trouble, it has takes from me about 4 days of searching and searching until i found a client claim that he was not received any info about his cloned VM, when i have checked i have found that the VM has the same hostname as our server, so we finally get the issue, it was stressed days.