How can master connect to a slave at a wrong I2C address?
What you are confusing is the 7 bit I2C address field (which is not an 8 bit or HEX field) with the 8 bit registers used by an MCU to build the logical address and direction flag. 
I wrote some coverage of this for a Raspberry pi book which might help you: 

 

Note: there is a mistake in the graphic above....the Slave address is 0x69 as shown in the bit values.

The register contents for you to begin a transaction with the first PCA6416A in your system using the software library would be 0x40 to write and 0x41 to read. 
For the second PCA6416A (ADDR=1) your register values would be 0x42 to write and 0x43 to read. 
And since the scanner software (which scans using only writes, and validates when it sees ACK from the slave) simply returns the ACK'd address in the upper 7 bits so you end up dealing with those HEX register values. Notice that in the datasheet they studiously avoid using HEX representation of data, and stay with bit values in 8 bit fields to avoid any confusion.  

The whole of Chapter 6 on I2C is here on Google books may perhaps help you.

There are two addressing schemas, 7 bit and 10 bit.
You can read up on the I2C addressing standards from http://www.i2c-bus.org/addressing/ or from NXP (Phillips) who developed the first devices, http://www.nxp.com/documents/user_manual/UM10204.pdf   

There is also a slow speed (100, 400, 1 Mbps) relaxed specification called SMBUS (and a similar PMBUS) which is used in virtually all PC motherboards for management tasks (power supplies, fans, temp sensors etc). You will see many implementations of these buses from 10k - 400k bps, but all are limited to 7 bit addressing.