The answer is; Only perform one filesystem action for one notify event.

SetProtection() and SetDate() are two separate actions,
each successful action generates one notify event regardless
of what object it is referencing. That's how it works.

When saving, it appears from that log that it is also SetProtection()'ing
the file too. The meta-data actions send the notifications immediately.
However, operations on a filehandle are deferred until Close()'ed.

If the file was overwritten or a new file created, you should also
get one change/add notification when the file is finally closed.

The reason is that DOS remembers the changed status in the
filehandle that was Open()'ed and when the file is Close()'ed,
it send another notification about the content change.

When using NRF_CALL_HOOK method, and not a message or signal,
you would receive either; NHM_ACTION_ADD or NHM_ACTION_CHANGE
in the nhm_Action field.
Note that NHM_ACTION_ADD overrides NHM_ACTION_CHANGE,
so in other words, an ADD implies a CHANGE, but not the other way around.