I noticed that there are a lot of 2 of 3 multisig transactions where one key has the private key 1. This makes them effectively 1 of 2 multisig, although I think the owner isn't aware of this.   Does anyone know, who is creating these?

Here is an example:
https://blockchain.info/tx/9aebe8dedd172d3662d0713ec94dff3ede1efca9b315b52be087872d06a93dc3

There is only a little address reuse.  I count over 1000 different addresses in the last three months.