could be “automatic allowance of inbound loopback traffic on localhost 127.0.0.1” see:

http://outpostfirewall.com/forum/showthread.php?t=8790&page=1&pp=15