this could be a somewhat involved case but here are some key areas of concern for you:
1 - get a sample of one or more emails that is triggering your other anti-x engines. double check received by headers and x-ironport-antivirus/antispam headers to make sure the ironport is both sending these emails and scanning as well!
2 - if you determine that #1 criteria were met, use that sample and forward it to our threat operations center or appropriate vendor (i.e. mcafee,sophos) for analysis if it is a confirmed false positive. depending on your setup, i can provide links for each.
3 - you can also take this time to run through your outbound policies for anti-spam and anti-virus and VOF and so on. double check your list of relay hosts (relay sender group in HAT) and make sure there aren't any unauthorized or infected hosts relaying traffic through the ironport.
the best way to rule out a problem with outbound reporting is to A) make sure the IronPort is at fault and B) isolate log messages or gui reports at specific time ranges which you believe to be incorrect. there are many scenarios that could cause a spam or viral message to exit your network and it may or may not involve the ESA.
i know it's a lot of info to swallow, so you may want to have a support case for this issue to assist with analysis, especially since false positives are generally time-sensitive and we want to update our rules if necessary ASAP.
happy hunting!
