That is interesting that it runs on the first URI. If a browser sends that your server probably sends a redirect message with the second URI. If you asked which would actually run the script I would have said 2 and 3 but not 1 so that in itself is interesting.

I wonder if your client program is taking the redirect and reposting without the relevant form input data?

Update: Look in your logs and see if there is a 304 near your other requests (The redirect) This would tell you the URL was hit twice but the script ran once once the redirect was followed.

Update2: Oops as pointed out 304 is not right, It's 302 or 301 depending.