a. 3 shell casings in the alleged SN, the majority of earwitnesses, the original FBI report
b. Someone planted 1 too many shells in the SN
The rifle being brought into the building with an empty shell casing already in the chamber would account for two shots and three casings. Cycle the bolt once to eject the empty and load the rifle, fire, cycle bolt again, fire, cycle again, decide not to shoot. 3 shells, two shots, one live bullet in the chamber.