In going through some of the older questions in the forums I found this and wanted to add a reply. Without having a log file from the iMFP and the Pharos EDI service it is hard to tell what had happened.
You indicate this was only one device, one time and one user out of the many users and 100 devices. This leads me to suspect something internal to the device went askew for a brief moment causing the copy count to be off or as you indicated this was "a" user, perhaps they requested something different from the touch panel and did not notice it until the copy was completed. It is hard to say if it was device error, software error or user error at this time.