It's just a script issue it turns out. OnDamage internally is being called just once but the player has two script delegates setup for the same action, due to some weirdness in how players are setup in multiplayer, causing the script to be executed twice for one damage event (so you are still only being damaged once).
I'll see if I can stamp that out but it probably wont be in the next patch, due to the delicate setup needed for spawning players in multiplayer.