Both the PayPal IPN and the customer returning to Ubercart cause uc_cart_complete_sale() to be called. The second time it's called, the order has a user id, which causes the logged in message to be displayed, despite the fact that the customer hasn't been logged in when returning from PayPal. I've added a check to this function to display the "existing user" message when the current user and the order's user aren't the same.