Frequency capping for in-app is implemented on a device level. There are two reasons why a device which was supposed to receive an in-app once, ends up receiving the in-app more than once.
App is reinstalled
When the app is uninstalled, all the data will get wiped out which includes the rules for the in-app that specify frequency capping. If the app is reinstalled and the campaign is still running, the device will qualify again in which case the in-app payload will get downloaded again on the app.
User has multiple devices
If the user has more than one device, they will see the in-app more than once as the payload will be sent to all the devices that user interacts with and the rules will be specified locally on each device.