Here is what might have happened.
Person A registers for the webinar and gets a confirmation email with the login details about connecting to the webinar.
Person A emails a copy of this confirmation email to Person B (thinking Person B might enjoy the webinar).
Person A and Person B join the webinar using the same log-in credentials. Thus both Person A and Person B show up in the Attendee list during the webinar as Person A.
The Registration report as well as the Attendance report will show Person A, but not Person B, because Person B never actually registered.
Both Person A and Person B could have participated in the entire webinar.
You can block this by allowing Attendees to connect only one time. If not, Attendees can connect multiple times using the same log-in credential. The legitimate reason for allowing this is if an Attendee connects, and GoTo locks up, and they have to rejoin. Sometimes GoTo thinks the first connection is still there. Or some people join with multiple devices. Maybe they want to see the webinar on their computer, but will use their smart phone or tablet because it has better microphone or speakers. I do not limit connections, but I am also not charging for my webinars.
I'm not saying that this is the case, but it happens on my account often.
