"...the vulnerability was initially identified in 1990..."

STIG scans are automated and the basis for identifying a finding is sometimes a lot different from the name. You have to decode the scanners script and compare the description with the code. In this case it is likely a "medium" finding that an email service is running and may be a risk. "May" and not "is". It requires a manual evaluation to confirm.

My favorite is the vulnerability identified as [redacted] which merely identifies the operating system as Windows. It is a High severity.