syslogd accepts arbitrary timestamps on messages read from /dev/log. If the message matches the pattern "??? ?? ??:??:?? " then it will be treated as a timestamp. syslogd should always prefix the message with the local machine's timestamp, and for backwards compatability, remove anything that looks like a timestamp from the start of the message to avoid the timestamp appearing twice. This is similar to bug id 10222.
Just clearing out old bugs here. This one was fixed ages ago! Current version of sysklogd is 1.41-22 .