What may be happening:
It could be that your mailserver(e.g. Exchange) handed the mail off to the Ironport appliance, who took responsibility for the message. Then, after any last outbound scanning and appending disclaimers, the Ironport appliance did a MX lookup to deliver the message and then upon trying to deliver the message to the appropriate destination, the Ironport MTA received a SMTP 5## error code.
Upon receiving the SMTP 5## error code, the Ironport appliance will consider this undeliverable to the destination and then turnaround and bounce it back to the original sender, which may be what you're observing.
Where to go from here:
It would be useful if you still have those bounce messages that were generated by the Ironport appliance. You can look up the original sender and intended recipient or subject line through the mail logs and find the corresponding timeframe when the Ironport MTA tried to establish a connection to the destination host. This will show up as an ICID event where the Ironport tried to connect to the destination host. I'm surprised that the bounce message didn't provide some info on the cause of the bounce.
References:
1. findevent is a good tool on the command line that you can use to search for messages.
How can I determine the disposition of a message using the mail logs?
http://tinyurl.com/jb7z4