Really interesting.
And soon there will be many more people trying to steal coins from that kind of addresses.

I believe his assumption that it is some wallets change address code doing this, is probably correct.
Would be great to know which wallet it is.