One thing that might reveal what's happening is a Process Monitor log:
That would show which code or component is opening and closing the archive. It can be a pain to work out which thing failed to close it, but it might be worth a look, if you want to make one and send it to us.
If you do send a log, please include details of the archive file name so we can filter on it.