No one's said anything about a firewall *on* the server. There are a number of routers and firewalls in between your clients and your server, and it's possible that one of them is broken. It's also possible that some client software is broken.

The first step you should take to figure it out is, as I said before, to get a list of all of the courierpop3login processes running on your system. Then use 'netstat -tnp' to determine whether those connections are open from just one host, or from many. Once you know who started the connections, then you'll have somewhere to look to find out why it's happening.