could be “automatic allowance of inbound loopback traffic on localhost 127.0.0.1” see:
http://outpostfirewall.com/forum/showthread.php?t=8790&page=1&pp=15