I think I have found the answer and thought I would post it in case it helps others.
I have two NICs in the server running 3CX and two WAN connections
The interface assigned to 3CX (the "3CX NIC") is directed to a static WAN IP by the router (pfSense).
The second interface (NIC #2) is directed to a dynamic WAN IP.
NIC #2 has a lower metric than the 3CX NIC. I think 3CX is sending SMTP traffic to the interface with the lowest metric, not the one that is assigned to 3CX in Settings/Network/Public IP/Select network card interface.
When I set the 3CX NIC to a lower metric than NIC #2, then 3CX would correctly send a Test email.
When I set NIC #2 back to the lower metric than the 3CX NIC then I get an authentication error when I tried to set a test email (AuthenticationInvalidCredentials: 5.7.0 Denied).
I did not need to restart the Services between tests.
I assume this issue arises because the 3CX SMTP server checks the source WAN IP address of the traffic against the static IP address in the 3CX settings. If the SMTP traffic goes out through the dynamic WAN, when 3CX checks the dynamic WAN IP address against the static WAN address specified in the 3CX settings they do not match. The system then generates an authentication error. That sounds plausible but I do not know if that is actually the reason.
I then set NIC #2 back to the lower metric and added a firewall rule in pfSense on the VLAN for NIC #2 to force all traffic to the 3CX SMTP port (2528) to go out through the static WAN gateway.
3CX now correctly sends the Test email.
I suppose there is some technical reason why 3CX sends SMTP traffic to the NIC with the lowest metric rather than to the interface selected for general 3CX use?