Yes, it does use the same credentials in all places:
1) <gel:email> tags
2) Notifications sent by the app service (e.g. 'late timesheet' notifications)
3) Notifications et by the bg service (e.g. 'job fail/success' or system notifications in processes outside of gel)
About the only place that would not use the same setup and credentials for smtp would be the email tag library that is part of jelly commons. That tag is not using any PPM code and so it has the expectation that you would provide it with the smtp hostname etc. as part of the attributes on the tag, but that isn't the one you are using above.
Things I would suspect at this point:
1) Changes made to the CSA that the app/bg services have not picked up. Although some configuration changes can be picked up dynamically, some others are read once into memory and reused for the lifetime of the application. A restart will be needed in those cases.
2) A disconnect between the contents of the properties.xml file on disk in the $NIKU_HOME/config folder, and the same database entry in the results of the query "select value from cmn_config where name = 'properties.xml'" - the contents should be identical in both places. If they are not, you may need to re-save information in the CSA and/or "push" the configuration from the disk (assuming it is correct there) into the DB through the use of the command line action "admin general upload-config".
Edit/update:
As for tracking, you could try enabling DEBUG level logging in the CSA on the following named categories to see if that will yield any clues:
com.niku.union.notification.NotificationDeliveryService
com.niku.union.notification
com.niku.union.notification.MailMessage
com.niku.union.notification.Utils
I've listed them in the order that I think might be the most helpful (especially in the tradeoff between getting pertinent information logged vs. being flooded unhelpfully), but you can choose whether to enable them in turn or all together, depending on how chatty your systems are.