Thanks, that’s what I was looking for, to narrow it down — if we could rule out the cron jobs getting duplicated in advance, then it’s definitely the processing/sending portion that causes the problem.
I’ve tried to trigger this myself again, by repeatedly adjusting a test server’s clock just before the time the report would be sent, using some different timezone settings and other options, and still can’t reproduce it.
For the other two sites that are on the same server — do they load much faster when you visit them with an empty cache? When I visit the one site I know of, it takes over 10 seconds to load on the first visit — sometimes delays like that can lead to 3 or 4 visits being processed at the same time, and/or finishing out of order. If I could confirm that, we may be able to fix the issue.
If you don’t mind sharing a copy of the site’s access log that covers the 14th, I may be able to see if a number of visits coming in closely together could be causing the issue. My email is: mattr (at) wordfence.com