Encrypted POP3, for clients that download messages and store them locally rather than leaving them on the server. TLS is established immediately, so unlike plain POP3 the password never crosses the network readable.
Fine, though IMAP suits anyone using more than one device far better.
Fine as configured. Consider whether IMAP would suit your users better than POP3 before leaving it in place.
The port scanner will tell you whether 995 is reachable on a host you control. Checking from outside your own network matters: a port can be open on the machine and still be blocked at the firewall, and it is the view from the internet that decides whether anyone else can reach it.
Only scan hosts you own or have permission to test.