If Symantec DLP catches an email twice, is an additional incident created?