The monitor should look at the times between polling. That is...it will start monitoring once it's installed (won't detect historic event logs) and should just watch the past interval...in this case 24 hours.
I'm not 100% sure on multiple hits but I'm fairly certain it will send 1 alert for each instance found. In the past this alert would run historically which caused problems (flooding) during installation and alert on every instance found in the history but that was changed several versions ago.
1 alert for each instance could be a problem