When viewing the Suspicious Conversations it appears to be only analyzing half of the SMTP and POP3 communications. There are bytes -> show 0 B...
Separate names with a comma.