I ended up opening a ticket for this when I encountered it on our SIEM. I believe in our case there was a user or users that were still connected to reports in the system and they had to be removed from them before their accounts could be deleted.
Here is what I did as directed by McAfee:
You will have to manually remove the email from the alarm/report that it is attached to. However we do have a way to figure out what reports/alarms the email is attached to. Follow these instructions to get the information
connect to esm database:
once connected run:
select * from emailaddress - get the id(second column) associated to user's email
select * from notifica where emailaddressid= - get the id(fourth column) of notification
select * from notifctn where id= - will return report/alarm information including the name
This allowed us to identify the reports and then go in and remove the account from them. On one of them I couldn't do it, so I copied the report and deleted the original. That made the ESM happy and I was able to delete the account after that.
Thank you so much for your help!