Finding the lost mails??

Hi,

I have a doubt since yesterday, when I done some manual statistics from all components 
who work in my old mail server:

I have more allowed connections than mail processed by qmail-scanner. Where are the rest 
of mail???

All logs used for this statistic are from 00H to 00H of next day and all traffic in my 
server is filtered by qmail-scanner, so I think that should there are same number of 
incoming connections and mail. Or at least, a similar number, maybe more mails than 
connections since it's allowed send some mails with only one connections, right?

Here the results:

* qmail-smtpd:

Total Conections: 110986
RBL blocked: 88503 (79.74%)

Total allow connections: 22483

* qmail-scanner:

Total E-mails processed: 18022 (80.15% of total allow connections)
E-mails blocked by qmail-scanner: 9994 (55.45% of Total E-mails processed)
    - SpamAssassin: 4456 (2758 reject, 1698 tagged)
    - Static rules of qmail-scanner: 5210
    - Mail without recipients and sender :328

Total emails allowed (clean mails): 8028 (44.54% of total E-mails processed, 7.23% of 
total connetions)

Beetween qmail-smtpd and qmail-scanner is running kav AV, but it only blocked 5-10 mails 
per day, so I didn't keep in mind.

PD: Maybe many mails to unknown recipients are discarded by qmail-send before to arrive to qmail-scanner? (in this server, I haven't rcptcheck)