Well, that explains why changing the severity of the alarm prevents the URL from being appended multiple times. The AO profile only matches when the alarm has a severity of minor.
It still does not make much sense to me that the URL is appended multiple times, but I think the AO must match every time the alarm is updated even if that update originates internally. As I said earlier, I did not think that was the behavior, but I cannot be sure I ever directly witnessed anything different. Either I have just never come across this type of situation or the behavior has changed somewhere along the way.
It looks like you are matching a count of 1, so what if you changed the AO profile to run on overdue age of 5s rather than on arrival? That should make sure the script runs only once. (You can remove the count from the match criteria then, although it should work the same even if you leave it there.) Note that you will probably lose the URL when the alarm repeats after five minutes, but that should happen with the profile configured as is anyway.