Joe,
I appreciate you taking the time to help, it has helped us understand the behavior of MAL events.
The majority of MAL alarms in our environment behave properly it is only in a few cases that we see this behavior.
We noticed that if a device loses snmp connectivity then an action is performed on the device such as a reboot or services restart and it remains with no snmp communication a new MAL alarm is generated thus incrementing the occurrence count.
We have not been able to solve the issue but at least, with your help, were able to narrow down to a possible cause.
thank you