Due to a bug in refactoring the extension setup for TimedMediaHandler, MP4 video uploads were accidentally enabled from about August 1 until today.
The bug was that file extensions were added to the enabled list twice, but 'mp4' removed only once, leaving the doubled copy in the enabled list.
Fix was to only add the set once; this was deployed a few minutes ago. An AbuseFilter rule was also put in place over the weekend to prevent further uploads.
There are a few dozen affected files on Commons and possibly various local sites. We've deployed the fix which has re-disabled MP4, and I'll do a scan for remaining files later today and either put them on the delete queue or replace them with WebM versions.