Thank you Mei Chan.  We are using Totara Sync which has the auth col.  It only appears a few users are receiving the welcome email with the link to change password.  I think what is happening is these users accessed the system before the sync file ran and created a user account so it was created via the ldap auth and allowed them to log in and created an account which triggers the email.

At the moment the sync file is uploaded manually (but v soon it will be automatically run so should stop the issue.

Thank you for your advice though.

Andy