Having spent a while debugging this, I thought I'd post here so others can save some time.
The error from Outlook 2011 is: "The SMTP server does not recognize any of the authentication methods supported by Outlook. Error code: -17092".
All other modern email clients are able to send and receive email happily, just Outlook 2011.
The issue is around the "250-AUTH PLAIN" response that SMTP gives. Outlook 2011, just like old Outlook versions from 10 years ago require "LOGIN" as well.
The fix for me was to add this line to my dovecot.conf: auth_mechanisms = plain login
