Not sure why, but some miners which were reporting themselves as "phoenix" already performed some ghetto-style ntime rolling. They were using one job for many minutes, only extending the ntime, which is corrupted behaviour (miner should ask for new job even when there's no new bitcoin block, to refresh his merkle tree). Not sure if it was done by unofficial patch floating on the Internet, but I implemented few workarounds especially because of such issues with phoenix.