It's completely normal for members to be in both groups.
The NEVER permissions of certain actions like being able to PM and being able to post without approval override those of the registered users group and thus stop them from doing those actions.
When they get to the set limit they drop out of the NRU group and assume full registered user permissions.
Note that if you change the new member post limit it is only applicable to new accounts created after that change. So anyone who was in the NRU group when it was set to 5 will still have the limitations until they get to 5 posts.
You can either remove them from the group manually or resync the group members with the Support Toolkit