Why is log file showing starttls when connecting via port 563

We are running inn2 2.6.3 on Debian buster. We have configured our 
server to listen on port 563 using xinetd.

While everything appears to work, when I connect using Thunderbird over 
port 563 and authenticate using username and password, I see these 
messages in the file /var/log/news/news.notice:

Feb 27 06:57:53 usenet-dev nnrpd[13246]: dnab42128a.example.edu group 
leland.alerts.certificates 77
Feb 27 06:57:53 usenet-dev nnrpd[13246]: dnab42128a.example.edu exit 
articles 177 groups 3
Feb 27 06:57:53 usenet-dev nnrpd[13246]: dnab42128a.example.edu times 
user 0.053 system 0.033 idle 0.115 elapsed 1394.103
Feb 27 06:57:53 usenet-dev nnrpd[13246]: dnab42128a.example.edu artstats 
get 177 time 0 size 622115
Feb 27 06:57:53 usenet-dev nnrpd[13246]: dnab42128a.example.edu 
overstats count 1 hit 355 miss 4 time 0 size 95566 dbz 0 seek 0 get\
  0 artcheck 3
Feb 27 06:57:53 usenet-dev nnrpd[13262]: dnab42128a.example.edu group 
leland.alerts.certificates 178
Feb 27 06:57:53 usenet-dev nnrpd[13262]: dnab42128a.example.edu exit 
articles 178 groups 1
Feb 27 06:57:53 usenet-dev nnrpd[13262]: dnab42128a.example.edu times 
user 0.026 system 0.026 idle 0.074 elapsed 1321.088
Feb 27 06:57:53 usenet-dev nnrpd[13262]: dnab42128a.example.edu artstats 
get 178 time 0 size 627953
Feb 27 06:57:53 usenet-dev nnrpd[13262]: dnab42128a.example.edu time 
1321089 readart 287(178) nntpwrite 14(728)
Feb 27 06:57:53 usenet-dev nnrpd[13246]: dnab42128a.example.edu time 
1394108 readart 272(177) nntpwrite 52(10013)
** Feb 27 06:58:13 usenet-dev nnrpd[13829]: starttls: TLSv1.3 with 
cipher TLS_AES_256_GCM_SHA384 (256/256 bits) no authentication
** Feb 27 06:58:13 usenet-dev nnrpd[13829]: dnab42128a.example.edu 
(191.66.18.138) connect - port 119
Feb 27 06:58:23 usenet-dev nnrpd[13829]: dnab42128a.example.edu user 
[email protected]
Feb 27 06:58:23 usenet-dev nnrpd[13829]: tradindexed: index inode 
mismatch for leland.alerts.certificates

1. Why is starttls happening? I thought that using port 563 gave you a 
direct TLS connection.

2. Why is port 119 listed? I am connecting via port 563 not 119. Using 
tcpdump I am not seeing any traffic on port 119.

3. There are several log lines listing group access _before_ the 
starttls line. Does that mean that there is unencrypted traffic at the 
beginning?

---

Here is our xinetd configuration file for nntps:

service nntps
{
         disable         = no
         socket_type     = stream
         protocol        = tcp
         wait            = no
         user            = news
         group           = ssl-cert
         groups          = yes
         server          = /usr/lib/news/bin/nnrpd
         server_args     = -c /etc/news/readers-ssl.conf -S
         instances       = UNLIMITED
}

---

A. Lewenberg