On the EV server, Event ID 3476 will be logged in the EV event log indicating that archiving has been enabled for the same user on a daily basis.
This may happen when users are provisioned in more than one EV Site (such as North America and EMEA). When a user is migrated from a region served by EV site 'A' to another region served by EV site 'B', they cannot be left enabled in site A's provisioning group. The EV Provisioning task will run in the migrated site 'B', detect the new user and send its own welcome message. The EV Provisioning task in site 'A' still believes that they are supposed to archive the mailbox, so its own provisioning task will add them as a newly re-enabled user, once again sending its own welcome message. This will continue to loop with welcome messages being sent from each site.
NOTE: In this case, depending on the timing of both the provisioning and mailbox archiving tasks, it is very possible that items may reside in archives in both sites, especially with Vault Cache and Virtual Vault being enabled. In this event, items may be restored to the mailbox from the old site and re-archived in the proper site. The old archive may be deleted if desired.
The user should be removed as a provisioning target in one site, leaving just the remaining site to keep them enabled. No further welcome messages should be sent out.