SCOM Closed Email Alert

I notice that when the alert is closed and we get an email the value is different and in some cases it is higher above the threshold than when it was first opened and new.

Is this because SCOM gives you the last retrieved value for that monitor/rule in the closed alert?

For example a disk space alert is sent saying less than 10% left and NEW. Then after we add more disk space there is a CLOSED alert sent but it says less than 3% left now.