Customer updated the origin on the hub, it hung a bit, and they had to kill the controller.exe process and restart it manually. Ever since then they had been receiving 2-emails for every alert received.
Components: hub probe, controller probe, emailgtw probe
As it turns out not only were there two instances of the emailgtw.exe process running (and once we killed one, only one email was received as expected), but there were multiple instances of many processes -> CA UIM and Windows processes. Recommended updating the machine until no more updates need to be applied.
1. Deactivate emailgtw
2. Kill both process instances (emailgtw.exe)
3. Activate emailgtw