A question about this post if I may? You say "the fourth email had 1 attachment but created 2 tasks both with attachments" ?
I follow (I think) the other 3 flagged emails in this post, but for this fourth email and the 2 tasks it seems to have generated, the tasks have totally different descriptions! ("Watch the finale...." / "Your appointment...") that in itself seems illogical, so perhaps that finding out what it happening there will point you in the right direction.
I have to say that trying to follow your problem is very difficult with the data you're providing. It would be useful to see examples of (suitably censored) emails that generated triggers against the results they produced...
best of luck!