Understanding what's happening
Your question seems like a variation of the question 'Why is my rule that reacts on event "After updating an existing user account" firing twice?'. The accepted answer in that question might help to understand your issue (what's causing it) also, ie:
some other module code is calling a
hook_user_update triggering the rules event a second time.
If I was to debug this, I'd disable all contributed modules (except "Rules" and "Entity API") to check if it's indeed a contributed module (I don't expect it to be core). And then re-enable the contributed modules one by one until the issue comes back. As soon as it comes back, you pinpointed the contributed module causing the issue, and you can start working on a possible remedy for that.
That question also has another answer with a very interesting workaround, with an image which looks like so (a picture is worth more then 1000 words):
Another workaround to prevent this issue from happening, is to improve your existing rule to make it similar to the rule included in my answer to "How to implement a Rules Condition like [account:last-login] = never?". More specifically:
- Add a Rules Condition like: User does NOT (!!!) have a role with role id = "
- Add a Rules Action like: Grant User the role with role id = "
So this improvement of your rule will check if the user does not yet have some (designated) role with role id = "
4" (adapt to whatever role id that fits your case). If that's the case, then the user is granted that role. With this improvement to your existing rule, this is what will happen:
- The 1st time your Rules Actions will still be performed (and grants the designated role).
- the 2nd time not ALL of your Rules Conditions will be satisfied (since the designated role was granted before), and therefor your Rules Actions will no longer be performed.