Check in /var/log/zimbra.log for that email address. Ensure that you are not allowing relaying aswell. You can also use
Code:
su - zimbra
zmmsgtrace -r eq-4p@xr_haig.roup.com
to trace it through Zimbra. Somebody may just have spoofed your domain aswell, so you are effectively getting the backscatter from it.