You have multiple policies with response rules to modify the SMTP message by adding a header field. The policies are generating incidents that show that the header was modified, but in the received message only one header was added.

If the header field to be modified (the portion before the colon) is the same for multiple response rules, only one field will be inserted. For example, if one response rule uses the field "X-Cfilter: Encrypt" and another uses "X-Cfilter: Quarantine" only one of the two fields will appear in the message.

Symantec recommends using completely distinct fields for each response rule. Continuing the above example, you could use "X-Cfilter-Encrypt: True" and "X-Cfilter-Quarantine: True" or similar header fields, to avoid this issue.