The Active Administrator agent installed on Domain Controllers (DC) collects security events recorded on the DC Event Viewer\Security Events and writes these to the Active Administrator database. These events written to the database trigger email notification from Active Administrator. Some Active Directory account management processes create multiple security events on the DC.
A Security Group membership change creates 5 to 6 security events. Security Group Management events and Directory Service Change events. Every one of these events can produce an individual email from Active Administrator.
Creating an Active Directory user account can create up to 12 security events written to the DC event viewer. Every one of these events can produce an individual email from Active Administrator.