When there is a spam outbreak, FortiGuard antispam service may need some time to update its database. In this case, FortiMail can hold the suspicious email for a short period of time before it queries the FortiGuard server for the second time.