Anyways 2.8 pending is better then 0 total

But it
can't be after a zap & rescan,
Sure it can...
Note that it is possible for someone else to keep a copy of any unconfirmed transaction that you have ever broadcast to the network. As long as that unconfirmed transaction is still valid, they could re-broadcast it without your permission. Therefore, it is possible that, at some time after the re-scan, an old unconfirmed transaction could show up in your wallet again.
He should be able to see the unconfirmed transactions in the wallet. A getrawtransaction on those transaction IDs should provide the information on where those pending bitcoins are going to or coming from.