POP3 is only used by end users getting their email from the destination email server. That means that someone sent your user a virus. That being said, at some point, the email that was downloaded that had the virus was sent to your email server. That happened via SMTP, or, if it came from an internal user, maybe some proprietary mail protocol -- probably only likely if you're using Outlook and Exchange.