You would/ should use 301 to fix a 404 error, and direct to the correct content.  404 pages are for when their is no correct content (mistyped url), but ultimately you never want a link to a 404 on your site

its call 404 ERROR for a reason

"p/s: I have just add robots.txt to sandbox and disallow all pages."

That will do it, just have to wait till google picks up on those instructions (might take a while)

"diluting your authority by having dofollow links"  I thought it was not possible to link sclupt in this way, I'm I missing something?

My understanding is that all no follow does is not pass authority and does not help retain authority ( basicly it just throws it out the window the authority it would have passed to that link)

So you think these would hide these links from goggle's bot, but will be usable for the end user?

I know the "no follow" link sculpting does not work, and I'm sure google would be switched on to tricks to hide links to sculpt.  If the trick does work, its the type of thing google does not want you to do, so I wouldn't do it incase I get punished by google down the line.  (maybe I missunderstand what your trying to do).

I'm not familiar with that type of link, so I don't know if it would work on a technical level.

"However i have double checked that where is no external link to the webmail pages from any other source"

the link might be so obscure that seomoz has not picked it up and google bot has.  Note in WMT there is "latest back links" but there is a few weeks delay on them, so the link might be recent.

I'm 99% sure there has to be a link from somewhere, or there is no way google can find that page.

I have added the No-index as well in  my robot.txt file on my site but yet no change.

It will not take effect until the next time google crawls your site, I think it took a week or so before my test site was removed (i did no robot.txt file too)

there must be a link from somewhere for google to pick it up,  I had a test site on a sub domain that got picked up to my surprise. The reason, the site had pinterest button on the product pages, and the developer had tested it to see if it worked, and later removed it, but someone (or something) repinned it and then a backlink to my test site was born

Point is there are millions of ways to get a back-link accidentally .

Best way not to list is either added it to you robots.txt file or add No-index to the webmail page