Probably not illegal or any kind of breach on the part of "the company we hired to manage the 401K ." The question of whom to blame depends on your relationships - is one company handling the investments and "third party administration" (in your view, that is probably preparing the Form 5500, although there is a lot more to it than that)? Or do you have one company that does the investments and one that does administration?
In a perfect world, you and/or the payroll company know enough to stop payments on the first loan when that loan is paid off, and the administrator and/or recordkeeper recognize this and have no reason to ask questions. In a less perfect world, loan payments keep coming but someone, probably the third party administrator, recognizes this and says "wait a sec, did you mean to keep doing this?" (Often, participants want to continue the same total payments in order to pay off the second loan sooner.) In a less, less perfect world, loan payments keep coming and someone shrugs their shoulders (or an automated system effectively does the same thing) and applies the payments to the second loan.
I like to think of our firm as being in the camp that would recognize and address this right away, but depending on a lot of factors, we might not even know about this until well after the fact.
Not to be too blunt but ultimately any legal liability lies with the participant and the employer for not knowing enough to stop payments when the loan is paid off. When an investment company receives money they have to do something with it and applying it to another loan is the most logical option. Whether someone else c/should have caught this earlier depends on relationships and what you are paying them to do.