Thanks for the originate-coa tip, I didn't know about that.
Updating the User-Name entry should result in it being replaced, not
added to. I suspect you're misreading the debug output.
And there's no need to run radclient to disconnect a user. See
raddb/sites-available/originate-coa. The server core can do this.