If it's something you can reproduce fairly easily, could you get a Process Monitor log of what happens? We should be able to use that to see where the file is going, and which code is doing it.
Is the metadata panel set to auto-apply ("Apply" checkbox at the top of it)? Does it still happen if that's turned off, or is that part of what triggers it?