Bob,
static (in,out) tcp x.x.x.x 587 y.y.y.y 25
The above rule says that when incoming TCP traffic destined to port 587 reaches IP x.x.x.x (public IP for the mail server), the firewall will translate that connection to y.y.y.y (internal or real IP of the mail server) on port 25
In this way, the outside users will connect to the public IP on port 587, but the traffic will be forwarded to the mail server on its regular port 25
Federico.