Still on GW2012 for various reasons

I have about 65K emails in GWIA Defer folder

Looking at several dozen these seem to come from Outside - external IP

with sender being sales@mydomain.com
Sending client seems to be Outlook Express!

The Server is NOT open relay
Both IMAP and POP are NOT enabled

Only GW and Webaccess

any ideas / where to look would be appreciated