I've been following how timed actions work for many, many years now. It has wavered a bit, but it keeps to the design we originally had:
If the time of a loopback action is not in the future, it is ignored on a loopback action. This prevents the same timer going off forever.
In version 9, this seems to have been broken by making some of the time validation in the database, and some on the engine. If you have a database 1 hour behind your engine, for example, your timed action will repeat continuously for an hour. Metastorm state that the database and engine should be in the same time zone, and DST should be disabled for both (making it almost impossible to use anywhere DST is employed, but I'll look at that later). These are all new requirements for version 9, BTW.
The trouble is, if the database is even 1 second behind the engine, the timed action repeats for that one second. The chances of that occurring are very, very high, I'm afraid. This explains a lot of unexpected activity we have been having in production systems.
More details:
http://metastorm.processmapping.com.au/post?id=5011015
