The complete message tracking would certainly help determine which destination server bounced the email.
The delivery connection ID (DCID) in message tracking should display what interface of the ESA attempted to deliver the email to what MTA IP.
You can also compare message tracking for the email that delivered to see if the email were going to the same MTA using the same interface.
Since the bounce error is generic with not much details, on the ESA we can only setup a packet capture to confirm the connection was closed externally.
Regards,
Libin