Whenever there's a file change, I typically receive 5 emails.
The first 4 say "A file (or files) on your site at ... have been changed. Please review the report below to verify changes are not the result of a compromise." There is no "report below". These 4 are sent with exactly the same send time.
Some time later I'll receive 1 email containing the actual information.