In some cases ILP started to send multiple copies of email to external recipients.
Looking at the smail-[datetime] log files I've found some obscure lines like this:
"End of socket stream data (2) No such file or directory" (many times)
"Network kernel error (32) Broken pipe" (few times)
In *all* cases the original email had a pdf attached