On what port do you have the webadmin page listening?
You can only access the webadmin page from outside if you have allowed administration in your firewall (external to zentyal)
If you have administration on the same port as webmail, and allowed that port from external to zentyal, you can reach administration from the internet.
The sollution is to change the port for the administration page and disallow administration to be accessed from external to Zentyal. If you need to use the admin page from the internet, you can use a VPN to establish a secure connection inside the LAN and use the webadmin from an inside IP address.