I am quite sure they have only the licenses that I have given to them. That is not the issue.
The issue is definitely duplicate names. That's why I asked what triggers QlikViewServer to generate this pgo (or .xml) file?
I have already confirmed that the dialog for assigning licenses does not show duplicates - only one of the two (in those two examples I have tested) - so I guess there are old names in the xml which are not pulled from the AD - although they are there, only they are inactive - that dialog recognizes that, so I guess that wouldn't end up in a fresh xml file.