I appreciate your suggestion, but at the time I decided to let ASSP handle port 587, I came to the conclusion it does a much better job than postfix itself. I tried that setting too (not 100% sure it's exactly that setting).
I don't want all those Apple users on my neck again, although I can't...