As far as I know It can and did happen.
On a protocol level, 2 separate nodes (or the same node) can construct two different (or the same) onions and initiate the routing process.
On a protocol level I am not aware of any mechanics to prevent two htlcs on the same channel with the same payment hash, and on different channels, this is obviously not encoded to the protocol. In particular, while there might be a rule that the recipient SHOULD NOT release the preimage more than once, I don't see any way to detect or prevent such a behavior without drastic protocol changes.
The situation becomes worse once we implement base AMP in which a recipient node expects several htlcs anyway and overpayment is also part of the expected protocol behavior.
A little off topic: AMP also allows a denial of service attack vector by just denying the second onion with the same payment hash to be forwarded.