That's what I thought.  Only a DNN developer could even hazard a guess as to what circumstances would allow this to happen. I'm going to run a query on the DNN DB and see if any other users are "out of synch". I reply again if I find anything.
~gpe

I ran a query on the DNN DB and found one other instance in which aspnet_membership.IsApproved is out of sync with aspnet_membership.IsApproved.  The query I ran is:

select m.isapproved,up.authorised, m.userid, du.*
    from dnn_users du
    JOIN dnn_userportals up ON (du.userid = up.userid)
    JOIN aspnet_users u ON (du.username = u.username)
    JOIN aspnet_membership m ON (u.userid = m.userid)
where (m.isapproved = 0 and up.authorised = 1) OR (m.isapproved = 1 and up.authorised = 0)

I also found a bunch of rows (30) in which aspnet_membership.IsApproved = 1 and aspnet_membership.IsApproved = 0 but in looking at several other DNN DBs with lots of users, this looks to be normal and it makes sense to me.

One other note, the Users in this particular website are registered using the Dynamic Registration module from Data Springs.  Could there be a flaw in THEIR code that would allow this situation to exist or would they merely be making calls to core DNN functions anyway?