What is happening
We had a few users in our database that got created with the same username as another user. We fixed it with the extension merge users and that suspended the old user. Once we upgrade to 3.5.6 we got an error on login that says mdl_login() multiple found. Then returns an error as the $user variable. Since it returns an error Moodle thinks there is no user and for every login moodle will create a new user. We has some users that got up to 15 users created in 3 days.
When a username is stored in the database and one is suspended I would expect moodle to grab the unsuspended user and log the user in on the active user.
When a username is stored twice in the database and none are suspended I would expect moodle to grab one of the users, preferably the lowest ID number and log the user in on that user. Before the bug in 3.5.6 the user would be logged in, but sometimes it was inconsistent on which user they would be logged in as.
Delete all duplicate users. You can not have the user Suspended, they must be deleted from the database.