hook_user_login being called twice?
I know this is not an answer (I don't yet have enough reputation to post a comment); I am also uncertain if you are still looking for answer. It is possible sometimes for distributed modules to call user_login_submit.

For example, the D7 LDAP module's _ldap_authentication_user_login_authenticate_validate calls user_login_submit, which causes the user login form to fork two calls to user_login_finalize, both of which triggers hook_user_login. If you are still experiencing this problem, one possible way to debug your application is to use PHP XDebug, and dsm function traces.

After you have installed XDebug, you can use xdebug_call_function() on user_login_submit, user_login_finalize, user_module_invoke to see where the two calls of hook_user_login are coming from. I hope this helps.