Sent in from the desktop and mobile apps, including installs that are locked out or never activated - that is often exactly what is being reported.

Only you see this - companies never set up or see any email settings. SMTP sends your campaign emails, every invoice emailed from the system (companies' invoices go out with their name and reply-to address), and notifications (enquiries, support, approvals). IMAP polls the inbox every couple of minutes so a lead's reply shows up as a notification here - nothing is sent back automatically. Most providers (Gmail, Outlook) use the same login for both; Gmail needs an app password, not your normal one, once 2-factor is on.