Scenario was Contact A had email mydomain.co.nz
Contact A then filled out a Join/Renew (not using checksum) and used mydomain.nz
Result was Contact B was created.
Those contacts were later identified and merged while keeping Contact A with their original .co.nz email. Contact B was hence in Trash with the .nz email.
Contact then again renewed by using the .nz email - and hence the dedupe rules matched with the contact in Trash and added the membership to that record ie Contact B.
Seems like this is a fuzzy area, if a Contact is in Trash, but meets the required 'matching rules' what should happen to eg Contributions and Memberships or any other data.