A long-forgotten machine on a DoD network sounds like the kind of host that could serve for idle scanning or any other technique using a forged source address and a predictable dummy host; I imagine that arpwatch takes a view of network security focused on classifying frames and less on connection behavior.