I got the following answer from Ironport-Support:
The method Email Security Monitor uses to count incoming mail depends on the number of recipients per message. For example, an incoming message from example.com sent to three recipients would count as three messages coming from that sender. Because messages blocked by reputation filtering do not actually enter the work queue, the appliance does not have access to the list of recipients for an incoming message. In this case, a multiplier is used to estimate the number of recipients. This multiplier was determined by IronPort Systems, Inc. and based upon research of a large sampling of existing customer data. The default value for the reputation multiplier is 3. But you can change the multiplier by running the reportingconfig > multiplier command in 5.0.In our company, this kind of mails makes over 55% of the "Incoming Mail" in 30 days.
What do you think: Is the default multiplier value (3) too high?
Do you have changed this value in your environment?
I have this problem too.