BuddyPress.org

Your explanation theoretically solves the blog ID 1 issue, if it applies not just during “signup” but also during “logged-in visit”.

But it still leaves open the question for why one of the many “normal” blogs acts the same as blog ID 1 in terms of adding every logged-in visitor as a contributor.

So based on your information, I just leave it for blog ID 1 and remove users once in a while manually – at least the new dashboard blog already works as well. Furthermore, I will just rebuild with a new ID the affected “normal” blog as it then should act as any other one recently created. Let’s see how that goes…