Likely a false positive based only on the version string returned in the connection response. It has likely already been patched in your particular version. You haven't mentioned which scanner you use, but it likely didn't actually try to exploit a buffer overflow - it's just basing what it sees on a database of versions and vulnerabilities.
** EDIT: THIS IS INCORRECT - SORRY: Also - the last time I read the specs (about 3 years ago) PCI compliance does not mean that you must pass any particular vulnerability scanning tool's tests - it only requires that you have procedures in place to do regular scanning and address issues, and the management controls to ensure that happens. **
I just reviewed the latest documents, and scanning by a compliant ASV appears to now be required. I may have misremembered, or it may have changed, either way, you're stuck with an outside company.
Did you actually fail a PCI audit, or is this just a service that claims to be a "PCI Compliant" scanner. Side note - have you read the revelant sections of PCI? If not, you should - it's not that bad.
Whatever scanner is telling you this, it should be giving you a vulnerability reference number from some publicly accessible vulnerability database. Give that a read, and then verify whether the package you have installed has that particular vulnerability patched or not, and then document that fact, and move on.
If you're paying an outside auditing firm to prepare you for a PCI audit and they aren't giving you these details, you should ask for them - and if they won't give them, run nessus yourself, it will tell you.
The open relay is correct - the external scanner service assumes it has the same view of your network as the rest of the internet. If you whitelist it, it's allowed to relay, and is going to assume everyone else is too. If port 25 is normally blocked to the public, then you should leave it blocked for the purposes of the scan - it's part of your security.