There is no doubt that the additional backup is occurring. Why dont you profile the backups and see the application name ? Is it possible that another job is kicked off by a windows scheduled task (@ scheduler) or something ? If its a regular occurrence, you only need to profile at the time the non scheduled backup is occurring, to get more color.