The issue is typically that you may be in an After Backup scenario, where EV puts items in to a pending state, archives the item and places them in the vault stores and then awaits for full backups to occur on the physical DVS files in the vault store partition and THEN turn them in to a full shortcut.
However if a cancel pending is performed or a pending shortcut timeout from the policy is made, it turns the item back from a pending shortcut in to a regular email again and then EV comes along and archives the item.
This is because when the pending item is turned back in to a shortcut, it removes things like the TransactionID which is a unique identifier to a message, and when EV goes back and rearchives it, it assigns a new transactionID and it gets rearchived again.
This behavior changed in EV9 and no longer does a cancel pending or a shortcut pending timeout strip the transaction ID, so the next time it gets archived, its just turned in to a shortcut as EV has already archived it once before.
As for cleaning it up, there is a duplicate cleaner which can be found here, but you must be running EV8 SP5:
http://www.symantec.com/business/support/index?page=content&id=TECH147479
https://www.linkedin.com/in/alex-allen-turl-07370146
