We ran into this issue as well. The problem is from the staging area dirs from jobs in local mode (via LocalJobRunner), which creates a staging area dir as <staging_root>/<user><random>/.staging instead of just <staging_root>/<user>/.staging in cluster mode. The issue is introduced with the security releases (since 0.20.20x) when the getStageAreaDir API is introduced.
The random number for the local mode is presumably used to avoid job collisions, since there is no jobtracker to issue unique job ids.
Mayb we can introduce a feature (mapreduce.job.staging.keep=<number of latest jobs to keep>) to prune these directories once in a while.