Duplicates usually occur when external IDs are missing, null, or not truly unique. Timing issues can also cause duplicates when concurrent requests attempt to insert before an ID is committed.
Another cause is case sensitivity or whitespace differences in external ID values, which Salesforce treats as distinct.
Ensuring strict uniqueness and validating incoming data reduces this risk significantly.
Takeaway: Upserts are only as reliable as the data keys they rely on.