RPM- two packages installed

[redhat at buglecreek.com]

We are required to scan our networks for current patch levels.  The
automated tool flags packages that need to be updated.  For example, it
said that it is required to update gnutls to the current version
(gnutls-1.0.20-3.2.1).  Doing a "rpm -qa | grep gnutls" outputs 
"gnutls-1.0.20-3.2.1" and also "gnutls-1.0.20-3".  I assume the scanner
is not smart enough to realize that the newer version is in fact
installed and is simply seeing that the older version is installed. My
question is how does two versions of the same package get installed?  I
know that if you do a rpm -i "newer version of pkg" it will install the
new one and leave the old one, but is there any other way that this can
happen?  I am seeing this quit a lot and am starting to wonder if
someone is installing new packages with rpm -i instead of rpm -U.  Also,
running up2date (with default config) should not leave the old package?
Correct?
This examples is on a Redhat ES4 install.

Thanks