Indicating that the connection was abruptly terminated. As this happened about 30 seconds after the the initial exchange of the MAIL FROM/RCPT TO recipients, it's likely that the disconnect it occurred while the payload of the email was being transmitted. It's thus possible that a firewall/antivirus/antispam (either the sender's or yours) has terminated the connection due to a virus or a malicious payload.

Only with a packet sniffer it would be possible to find out more details as to what is actually happening, but as the two source IPs in your email samples are different, I suspect you may be having this behavior from multiple sources, making the packet captures a bit complicated due to the large amounts of data if you're unable to filter the capture by IPs.

There should be at least one other line containing the same id (118643312) indicating a disconnect. Please note that it may appear several minutes after the tries you indicated above. Some servers/bots may just attempt to find the validity of a recipient by issuing the sequence of commands above and then either disconnect or let the smtp session expire. That IP (24.201.245.36) is a legitimate mail server, but there are several reports of it having been compromised and used to spam in the past years.