Users that belong to internal mail group got exposed and are getting external inbound emails.
Create a custom inbound content filtering policy that will check if the recipient belongs to the group to prevent getting external inbound mails. For more, refer to the documentation. Ensure that internal email accounts are not shared externally.