Still on GW2012 for various reasons

I have about 65K emails in GWIA Defer folder

Looking at several dozen these seem to come from Outside - external IP

with sender being
Sending client seems to be Outlook Express!

The Server is NOT open relay
Both IMAP and POP are NOT enabled

Only GW and Webaccess

any ideas / where to look would be appreciated