I was just searching the forums about a possible bug, when I saw this thread.
I created a custom race (for myself to play as) which appeared in my next metaverse (DA) game (where I played an in-built race) TWICE. There were 9 random opponents, TWO were my custom race. Both had same names etc. (for their homeworld and leader) but were separate AI players. There was only one such customracexml file in the metaverse directory.
A long time ago, I had experimentally created some custom races (again for myself to play as) using the in-built races - so those could have sometimes been my customized opponents while appearing to be in-built!
simply copy the *.customracexml files to another directory and then delete them
...although in the opponent set-up screen, clicking on a portrait allows a change to what seems to be a random selection of races - I guess you can replace custom races there, but I prefer to play the game not knowing my opponents until I meet them.