TRC10 token issuance comes with a lock-up feature. The total number of tokens held by users do not include locked tokens, so the above situation might occur if a TRC10 token is partially locked up. In a nutshell, TRC10 tokens = total tokens owned by all token holders + total tokens that are locked up.