To duplicate, just go to the User Permissions page for a MUC and try to add a user to a particular group multiple times. This can also happen through standard messaging means (not just the JSP entry point).
It’‘s not clear to me what second order effects this bug will have, but I’'d guess that to truly remove a user from a list, all entries of that user would need to be removed.
Jeff