Since the setup of a session involves a few steps, we don't count sessions for the <max_sessions> check until the startup has completed.
During this startup, we count sessions as "prestarted" (for instance in the JMX statistics of the ResourceMBean).
If a session starts when <max_sessions> is reached, it is refused immediately with the second log message.
If the session starts and <max_sessions> is not reached, it is allowed; but it may be refused later, when it tries to exit the prestarted state, if other sessions have preceded it.
In this case, you will see both messages.