It looks to me like one user has committed to the Application Security proposal twice. At the time of this writing, the commits are viewable on this page. At first glance, this looks like a dupe of this bug, but the behavior is actually slightly different in that the rep totals and badges do not match up as they did in the earlier bug. The hash-generated Gravatar does, though. Clicking on the username to the first commit goes to this profile; the second one goes to this one. Maybe something got cached wrong somewhere?
Apparently this is being resolved, so we can all feel good about the
[status-completed] on this post again.