What is a good cloud-based smtp mail forwarding service?

You have to have some control over the websites in order to configure the password reset email settings. You've activated the account https://help.sendinblue.com/hc/en-us/articles/209463245--How-can-I-get-my-Sendinblue-SMTP-account-activated-  as transactional.  

The difference being that a marketing email normally has a list of values and a template form that sends individual message pulling from the list of values. (a mail merge)   Why you are going over your limits means that a large amount of your users are requesting a password reset.

It could be that one webserver is sending the password reset and not getting back a response that it recognizes and then loops to try and send the email again even though the email was sent properly.

Analysis of the logs would show you what is going on. This could also be a crude form of DOS attack and the email address is getting rejected and you are not acting on the email rejection that is received from sendblue when they try and send to that email address.  i.e. if I set up a temporary email address of xyz@dwjohnson.ca get the confirmation email, then delete xyz email address on my email server now I try a password reset and you send to xyz and sendblue gets a NDR and your site doesn't realize that its an invalid email address and I keep doing the password reset via a script  eventually I will use up your quota.

Summary: The way I do this is have every client setup a MailGun account (with their credit card on the account), then I setup their DNS correctly.
_______

1) What is the best smtp forwarding server for "transactional email".

There are many options.

https://MailGun.com is my preference, as MailGun provides 100% of SMTP transactions in logs + Webhooks providing 100% of every message state change.

Mailgun makes debugging delivery problems trivial, compared with other relay services with abbreviated logs which make debugging impossible.

2) We just want people to be able to reset their application password by sending an email from their webserver on multiple domains, none of which we control.

To do this will require access to DNS for every domain, to correctly setup SPF/DKIM/DMARC records.

Without DNS access, this is impossible.

Either you or someone will have to setup DNS records, if you expect any level of deliverability.

Tip: It's easy to send email. Monumental to achieve Delivery + Inboxing.

3) Right now we are using sendinblue and it is just not working.  We keep increasing our service level and still get "you have reached your hourly quota..."

Reviewing full SMTP conversation logs is required to answer this for sure.

Likely reason, SPF/DKIM/DMARC records are incorrect, so when SMTP sends most Mailbox Providers (Gmail, Yahoo, Microsoft, etc...) return a soft error, which triggers a deferred resend.

Even for small lists, this can generate 1,000,000s of resends of the entire SMTP 7-10 backoff period.

If SendInBlue considers every resend a new charge... wow... I can see this producing overlimit conditions repeatedly.

4) I honestly don't know what we are paying for with sendinblue, and I don't care anymore.  I just want to find something better and using google search is very frustrating, everything is about "campaigns".

Try MailGun + be sure (as in my summary) to have each client open their own MailGun account, so if someone sends 1000s of messages, they pay the cost to cover these messages.

5) We don't have any "campaigns".  We just want customers to be able to reset pw by email.  SMTP forwarding.  Sendinblue calls it "transactional emails"  (they have a name for it, they just don't do it).

MailGun...

Any help is greatly, greatly appreciated.

6) Again, I am looking for a cloud solution.  I don't want to build my own mail server.

The term "Cloud" has no meaning in this context as Mail Relay services (like MailGun) will never describe their infrastructure to anyone.

Thanks again.

Thanks to both of you.

Very helpful.

You're welcome!

Good luck!