Multiple forwarding is normal if original email headers have additional email addresses. For example if monitored user sends email to one email address in TO: box and BCC: box contains yet two email addresses you will receive three copies of original email to your secret Email Spy address.
Also multiple forwarding is possible because of specific operation of some uncommon versions of SMTP servers when TO: box of delivered email contains several addresses.
IP Logged
Eric Nilsson Spydex Inc. Security Software Developer --------------------------- http://www.spydex.com