It turns out, the employee had purchased the new Motorola Droid and setup access to the server using IMAP (and never told anyone, of course). I never got my hands on the device to see how exactly he had it setup, but it was definitely the device replicating messages, though only in the 'Sent' folder.
After our Helpdesk reconfigured it to use Active Sync, the problem resolved itself.
In case anyone runs in to the same issue and is looking for a culprit, I found it by seeing this in the mailbox.log file (/opt/zimbra/log/mailbox.log)
returned tens of thousands of lines of the following:
grep username ./mailbox.log* | grep "Adding Message" | grep "folderName=Sent"
./mailbox.log.2009-12-31:2009-12-31 09:23:21,856 INFO [ImapSSLServer-196669] [name=username@mycompany;mid=1233;ip=70.209.xxx.xxx;] mailop - Adding Message: id=143160, Message-ID=<firstname.lastname@example.org>, parentId=18864, folderId=5, folderName=Sent.