First of all this is a known behaviour:
When Email Services are provisioned and before your MX records are changed, Symantec.cloud may process some of your emails. Emails that are sent to your domain(s) by other Email Services customers who are provisioned on the same infrastructure as you are processed. The portal Dashboard and reports may show that email has been received before the MX change.