This is a quick guess: maybe you monitor a file while its inode is changing. Do you (or a process) move /var/log/mail.log while monitoriing it? I suggest you have a look to http://permalink.gmane.org/gmane.comp.sysutils.incron/16, it helped me to understand better incron...