From what I've researched in the past, the first click/open is always the user event, followed by the ISP's automated clickthrough 2nd and 3rd times within the same second(s), this is the behaviour I've noticed at least in Microsoft. How about running a technical workflow to perform an hourly mainte...