I may be missing something… but how could the email scanner create an incoming connection? Isn’t it more likely that somebody from outside is trying to connect to your SMTP port (i.e. checking whether you have a SMTP open)?