ahh, yes.. the thing that has been plaguing io since.. ages? I was finally able to find reason for this, and found several methods to reproduce it (didn't try myself, but I'm quite sure this works)
Here's one of them:
#1. Login on ftp and authenticate yourself once (make sure you have 2 FTP logins)
#2. Login on ftp, but do NOT perform complete authentication. Only feed USER <login>.
#3. Upload a file with the authenticated account.
#4. QUIT the unauthenticated account (This simulates login error)
#5. QUIT the authenticated account
Login, authenticate & check the counter that shows total # of users logged in
What can I say.. Oops?