[Jon]

Technically they are 404's and should return 404's. Unfortunately X-Cart does not do this.

The pages are served through pages.php, product.php, etc. which are files that exist so don't throw 404's by default. To change this requires modifying the core code to find where the redirect or message occurs and changing the code to output a 404 header with an accompanying message. I've done this for clients prior but don't have the code at hand and am current booked through till summer sorry!