(Oops, sorry, an errant keyboard shortcut sent the email too early.)
Mirimir: aside from the nickname, do you have any reason to believe it was out of the ordinary? The exit policy mostly only seems to allow non-encrypted services (80 but not 443, 143 but not 993), but that alone isn't enough to give it the BadExit flag: