Hello! First, the Password Brute Force by Email IDS rule is very likely being triggered by an external user attempting to guess the password for this account. To correct that I recommend adjusting the Brute Force by IP rules so they engage sooner than the by email rule, which should prevent them attempting further from the same IP. 

The IDS rule duplication you are seeing is a concern though (if I'm understanding you correctly) and I recommend you submit a ticket on this as this is something I spotted recently in one of our test environments and we have escalated a request to development to investigate further. If you can get a ticket submitted with us including further details this may aid them in their review. Thanks!

Thanks Kyle, i've adjusted the IDS rules as suggested and it seems to be ok now.

Also since removing the duplicate IDS rules, they've not returned. I will keep an eye on them.