CUSIP is a 9 character long identifier. The last digit is a check sum checking the first 8 previous characters. This seems to me that it is not possible for two securities to have the same 8 characters and different check sum. I know this is not exactly quantitative, but I haven't found a forum where I could ask.
No, 9th character is computed using deterministic algorithm described here: http://en.wikipedia.org/wiki/CUSIP#Check_digit_pseudocode.