What OS is this? I've had issues on Debian/Ubuntu in the past where the kernel tries to be clever - if you connect to the external IP address on the same server that IP is assigned to, it actually routes it through the localhost adapter.

This issue had me stumped for ages when I was setting up a firewall - I was only allowing traffic in on the external adapter, but the firewall was blocking any requests made from that machine - turns out it was routing it through localhost which the firewall had been told to block.

In your case what you end up with is sendmail receiving the connection on localhost (127.0.0.1) but the EHLO stating the external ip.ad.dr.es - hence thinking its forged.

Just a shot in the dark, may not apply to your case. If you've got another server with sendmail available, try getting that one to connect to the external IP address on this sendmail server.

The correct way is to put the hostname after the address you want to resolve it as. This usually means the external address unless you have good reason to use the loopback address instead.