If I am not mistaken, only the owner of a published app can duplicate it on the HUB. This rule applies even for Rootadmins. But a Rootadmin should be able to duplicate the app via QMC.
The easiest option (no customization) is if user2 uses QMC to duplicate the app.
Another option is to use QMC to change the app owner to user2, then he can duplicate it via HUB.
And another option would be to modify/customize the security rules and let user2 duplicate the app even if he is not the owner. But this one I am not 100% sure if it is possible. I think I have tried this in the past and wasn't able to do it.