Solution
There are two ways to workaround the issue:
1. Set com.bmc.arsys.emaildaemon.UserChunkSize to be equal or less than Max-Entries-Per-Query so Email Engine knows to go back to arserver to retrieve all records
2. Set com.bmc.arsys.emaildaemon.FetchUserGroupInfoOnDemand=true which will not cache user/group info in EE cache but retrieve user info whenever authentication is needed. This will affect a performance a little bit.