I've seen this happen--it was a while ago, but if I recall, it happened because a lead was created first in Salesforce and converted to a contact--before it was imported into Marketo.
Reimporting into Marketo will create a new "lead", but the saleforce.com contact exists within Marketo as well--both with the same email address.
I don't know if there's any good way to avoid this from happening--we eventually created workflows where all leads were processed through Marketo first, then synced to Salesforce (rather than vice versa). Because the problem only occured on leads created in salesforce, it became less of an issue over time.