Keep investigating. This is a single system.
I would set addebug on keep it on until I get the alarm; once I get it, I'd look at the log for the exact time.
This may be an end user attempt too. Also, please make sure you're using 5.4.2 if this is Express.
R.P