Yeah, that's a major reason we recommend manual configuration using the server name (tommy.heliohost.org). Mail clients today check that the server name you enter against the name that the server identifies as when you connect, and the name on the certificate if applicable. The mail server on Tommy always announces itself as tommy.heliohost.org regardless of user, so when you use javalan.helioho.st as the host name, the client connects, gets a "Hi I'm a mail server called tommy.heliohost.org" and the client goes "WTF that doesn't look like javalan.helioho.st, I'll show a warning about it".
The tommy certificate is always renewed automatically and using the server host name means the server HELO announcement matches the host name.
That said, I just ran the renewal for your SSL certificate manually for you. You can do this yourself in the future in Plesk under SSL/TLS certificates->Reissue Certificate->Install under the Lets Encrypt option->make sure to check the box that says "Secure mail on this domain"->Get it free.