I just had this issue pop up for a user today, however the same pre-conditions don’t appear to have been met. The user hasn’t been deleted or recreated, which makes me unsure how they would have gotten the second externalid. This is not a new user, however their last login was a few months ago.
{"exception": "MultipleObjectsReturned", "message": "get() returned more than one Spuserexternalid -- it returned 2!"
Looking at the response of /api/spuserexternalid/, I see a duplicate for another user, who also does not appear to have logged in for a few months. This user has also not been deleted and recreated.