I'm pretty sure thats when you have an item thats archived, you restore it to your mailbox, you delete the retention category, then you re-archive it, because i think when an item is restored, EV will keep certain properties on that email, such as dates and times and also the retention category
so maybe it came from a test environment or a user that had EV in another environment?

one other thing, do you also have event id 2270?

If yes, check this out:

http://seer.entsupport.symantec.com/docs/336885.htm
ssue : Event ID 3172 and Event Id 2270 prevents Enterprise Vault from archiving an email item for a specific user

Details:
Following error is logged in the Windows Event Log:
Event Type: Error
Event Source: Enterprise Vault
Event Category: Archive Task
Event ID: 3172
Date: 06/11/2009
Time: 10:39:08
User: N/A
Computer: BKADEV01
Description:
An ArchiveMarkedItems request has failed.

Mailbox: /O=ABC & EVtest/OU=HEC/cn=Recipients/cn=XYZ
Folder:  

Error: An invalid retention category was detected while attempting to archive an item       [0xc0040cb8]

For more information, see Help and Support Center at http://evevent.symantec.com/rosetta/showevent.asp

Event Type: Warning
Event Source: Enterprise Vault
Event Category: Archive Task
Event ID: 2270
Date: 06/11/2009
Time: 10:39:08
User: N/A
Computer: BKADEV01
Description:
A queued operation exceeded the retry count and has been discarded

m_pIArchiveAction->ArchiveMarkedItems(ExchangeServer = "EXCA1",
MailboxDn = "/O=ABC & EVTest/OU=HEC/cn=Recipients/cn=XYZ",
FolderPath = " ",
PathSeparator = "AAAAAAAABLKBCABAAOLAKGECKMDMHDKCOKLGCEPIABAAKNCEHONCDMHAGCEJIDHIGGBPMHHJKHAJAAAGBNANAADKAAAA",
TimeStamp = "2009-11-06T10:38:58",
RetentionCategoryId = "",
AuthToken = "S-1-1-0 S-1-5-11 S-1-5-15 S-1-5-2 S-1-5-21-1108834912-2138070866-996114204-1033 S-1-5-21-1108834912-2138070866-996114204-1043 S-1-5-21-1108834912-2138070866-996114204-1045 S-1-5-21-2508644391-201732736-1330427892-12414 S-1-5-21-2508644391-201732736-1330427892-13314 S-1-5-21-2508644391-201732736-1330427892-15119 S-1-5-21-2508644391-201732736-1330427892-15121 S-1-5-21-2508644391-201732736-13

Cause : User is not enabled in Enterprise Vault

Solution:

1. Verify the mailbox is in the correct Provisioning Group
2. Enable the user through the 'Enable Mailboxes for Archiving' wizard
3. Synchronize mailbox