Hi Nate,
The funny thing is that if I look at the duplicate in Marketo, it says created Source:Salesforce.
If I check in Salesforce, it says it was created by Marketo!
One thing that I just found out, is that Salesforce 15 forced upgrade on Thursday night, which includes a DeDupe Catcher. Now when activated, the rules are set up automatically in Salesforce to catch not just email dupes, but First Name+Last Name+Company+Job Title.. which is amazing going forward, but not helping me find out the immediate culprit.