Richard,

If SpamFilter receives a "Read Timeout" error, it usually indicates that "something" is accepting SpamFilter's connection when SpamFilter tries to forward its emails, but does not allow a complete SMTP transaction to occur. If the Webshield service was completely shut off, and there wasn't anything "listening" on that server for SMTP traffic, SpamFilter would not be able to connect to it, and then yes, email would be queued up.
When you bring Webshield down, can you try, from a command prompt on SpamFilter's server, the following command:

telnet aaa.bbb.ccc.ddd 25  (substituting IP and port with that of Webshield)

If you get a:

Connecting To aaa.bbb.ccc.ddd...Could not open connection to the host, on port 25: Connect failed

then we may have to revisit this as SpamFilter should not connect and thus emails should be queued. But if you either get a connection (even a blank screen indicates a connection) or some sort of welcome banner, then wither Webshield is not completely down or another mail application is running on the server.

In the latest SpamFilter we have two new options in the SpamFilter.ini file to control when to queue emails or when to bounce them, depending on the error code output by your destination mail server. These however assume a successful connection to the dest server, so they may not apply to your case:

;Determines if SpamFilter should hold in the queue emails that were rejected by the destination SMTP server with an error in the 4xy range
QueueIfDestinationError400=true

;Determines if SpamFilter should hold in the queue emails that were rejected by the destination SMTP server with an error in the 5xy range
QueueIfDestinationError500=false