Thats interesting. I didn't know anything about normal forms, but a quick glance at G4G has some interesting information. I don't have the time to go through their full article at the moment, but its been added to my to do list.
Link for the lazy: https://www.geeksforgeeks.org/types-of-normal-forms-in-dbms/

Ah the old "malware detectors have the selectors for malware and so they show up as malware to other malware detection systems" problem.
Yeah, that seems like a reasonable case to have duplicate SSNs.