The five fields
Standard cron expressions have five fields: minute, hour, day of month, month, and day of week.
0 0 1 * 1
Why it runs more often
This expression means midnight on the first day of the month, or midnight every Monday. When both day-of-month and day-of-week are restricted, standard cron uses OR, not AND. In a month where the 1st is a Wednesday, it runs on the 1st and every Monday after it.
The first Monday
Standard cron cannot cleanly express “the first Monday of the month.” Put a day-of-week check inside the job, or use a scheduler with Quartz-style extensions.
AdroitPad's Cron Explainer shows the next six fire times and calls out this OR rule before you ship the schedule.