"Outbound scan" is the specific phrase, and IME it means one of three things, in descending order of how often I have seen it.
Your box was compromised and is scanning on someone else's behalf. This is the common one and people reject it instantly because they know they did not do it, which is not the same as it not happening. Second, something legitimate on the box looks like scanning to an automated detector — a monitoring loop, a health check hitting a range, a badly configured crawler. Third, a neighbour on the same /24 did it and the complaint got attributed by netblock rather than by address, which happens more than any host will admit.
You can usually tell which after the fact if you took the disk image before they wiped it, and you did not, because nobody does. For next time, ship logs off the box as they are written:
# /etc/rsyslog.d/90-remote.conf — logs leave before the box does
*.* @@logs.internal:6514
$ActionQueueType LinkedList
$ActionQueueFileName remotefwd
$ActionResumeRetryCount -1
$ActionQueueSaveOnShutdown on
Without that, "was not me" is a thing you believe rather than a thing you can show, and the abuse desk has a machine-generated report and you have a feeling.