If the process_message_queue process has been started and is not yet finished running and a patron uses the Password Recovery function in the OPAC, mails that were due to be sent by process_message_queue can be accidentally duplicated and sent out multiple times.
In our case the message queue was running around 05:00 AM ish and was not yet done. While it was running, a patron somehow used the OPAC Password Recovery function 10 times in a single second, maybe it was possible that their internet was down, they clicked on the password recovery link 10 times, then their internet went back up and the HTTP requests were sent. Anyway process_message_queue then sent 10 duplicates of all mails that were still not yet sent. 
Unfortunately I'm not really sure how to reproduce the issue. You could try:
- have message queue running and not yet finished with mails to your own email address
- use the password recovery function in the OPAC
- see if duplicate mails land in your inbox