When receiving a DCC file, the filename may contain directory separator that is not the platform-native one (for example "/" received on Windows or "\" received on Linux). This separator may be interpreted as a directory separator, so the file could be written outside of the configured download path.
Xfer never overwrites existing files, so if a file exists with the same name, a suffix like ".1" is appended to the filename.
Mitigation
Unload xfer plugin with command: /plugin unload xfer and see: /help weechat.plugin.autoload.