If you enabled spam outbreak protection in an antispam profile, FortiMail will temporarily hold suspicious email for a certain period of time (configuragle with CLI command config system fortiguard antispam set outbreak-protection-period) if the enabled FortiGuard antispam check (block IP and/or URI filter) returns no result. After the specified time interval, FortiMail will query the FortiGuard server for the second time. This provides an opportunity for the FortiGuard antispam service to update its database in cases a spam outbreak occurs.

To view the email on hold, go to Monitor > Mail Queue > FortiGuard Outbreak Protection.