An editor creates a sockpuppet account to have discussion on a hot topic. The editor does not want this discussion associated with the main account. Checkusers are run, and the two accounts are reconciled.
Here's the rub: when I do a sockpuppet investigation and develop strong suspicions (or even locate a smoking gun, which sometimes happens) the editor who violated policy often invents some specious claim to pretend his or her actions were legitimate. So sure, there are legitimate reasons to operate sockpuppets. Perhaps the noblest is to blow the whistle on sneaky abuse without becoming a target for disgruntled editors on one's main account. More often the "discussion" the editor wanted to join was an AFD where they'd already dropped by to say "keep".
******
OK, but how is that even possible. If neither the main account nor the sockpuppet are breaking policy, then a CU wouldn't reveal a correlation in the first place. (I guess it's possible if a completely different user happened to have used the same IP address, but otherwise?)
"And in general, the editing pattern of two separate people on an IP looks like the editing pattern of one editor keeping their accounts thoroughly separate, and I generally presume it to be the former case."
I disagree. Two different people will have different prose styles and different interests. As the total quantity of edits increases they become easier to distinguish. In some cases I've spotted a sockpuppet instantly, months after having investigated the sockmaster. I'll do follow up research to confirm or reject the suspicion, of course, but tigers don't change their stripes easily.
-Durova