I think it may be because the virus detection notification is still stored in the DB for 7 or 30 days as you said, so when KSC sends the report to my email, it appears to be duplicated. Currently, I just tried Reset Virus Counter on one device to 0 and wait to see if tomorrow when KSC sends report to email it still has any duplicate events or not.
Thank you.