If you have an SCM (subversion in my case) log message like this:

Deploy source & javadoc

It shows up in the change view like this:

Deploy source & javadoc

in the HTML that first ampersand is, of course, also escaped – hence "triple".

It appears that the triple escaping is present in the changelog.xml, so it must
be happening as the changes are being recorded, not when they are being displayed.