named users + smtp atuh probes

Could you change `PLAIN` to `\S+` for other authentication methods.
Also, doing a quick search, there is also examples without the the last string.[1]

Maybe below (note tweaked position of option space ` `):
`^%(__prefix_line)serror,relay=<HOST>,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?$`

[1]: http://copilotco.com/mail-archives/courier.2003/msg03605.html