With Exchange 2010, it's possible to have that message journalized several times because of the way the transport expands the Distribution List. The transport will try to send the message as soon as possible, so it "chips" the DL into chucks of 1000processes each chuck with any enabled transport agents (including the journal agent) then sends the first chuck of 1000. If you have a DL of, say, 4500 members, you'd get 5 messages in the journal. You can change the size of the "chip" to a value large enough that no DL would have more than the value of the "ExpansionSizeLimit". You have to make that change in the file edgetransport.exe.config on each HT server and then restart the transport service.
A big thankyou to Rich Matheisen [MVP] for explaining this to me.
The following comment was made from Ross Smith from Microsoft:
We don’t recommend changing the chipping size as it is a feature to help with memory management. Sure you can manipulate a knob and increase the number, but ultimately either a) there will be performance issues (undefined) or b) a message will still contain more recipients than the custom number entered. In other words, there is no guarantee a single message will always be used when generating the journal report.