If you've set up a string signature, then you may run into problems if that particular string is spread over two TCP packets, the IDS sensor won't pick them up then. If the signature is capturing most of them but missing a few, I'd say that's whats going on. You could verify with a Sniffer trace near your mail server and capture the ones that do get through. You may be able to shorten your string signature to something that will be able to grab it even when it's spread over two packets (or create a couple of string signatures, one with the first portion of the string and one with the last portion).
