This is a known bug in EE 2.9.0: https://support.ellislab.com/bugs/detail/20471/site-index-template-is-rendered-after-the-404-template
The fix from that thread:
Open system/expressionengine/libraries/Template.php and find this code on line 2236:
ee()->output->out_type = "404";
I don't know if it's also in the bug reports, but there is a note in the changelog for 2.9.1 :
Fixed a bug in the 404 redirect behavior when used inside a no_results
tag on an embedded template.
This might be your issue if it works as expected outside of an embed.
From Solspace support team:
Ideally, put the code for the Freeform error page alone in its own
template (eg. /contact/error), i.e. not with other, regular EE code.
In my case that tip works. Not sure which part of EE code interfere, but will dig deeper in that issue to find out.
There's always the Custom System Messages addon - http://devot-ee.com/add-ons/custom-system-messages - which allows you to run things like error messages through regular templates. That way EE upgrades don't affect the message text.
If you have Strict URLs turned off, then an incorrect third segment is most likely parsing the index.html template of the default template group. Unless that template has a way to verify the URL against an entry, it will parse normally everything that it can.
So, I'd work in a 404 solution for your default template. Two different options could be: