If heap page visibility map bit is wrongly set to all_visible, index-only scan can give duplicates (in effect new and old versions of the same row), with no apparent corruption of neither index nor heap relation. It just skips checking visibility of tuples in heap. Not sure it's the case now, but I've seen this previousy.
It could be diagnosed by deletion of VM file for a relation, the error (if it is this error) will disappear.
