It happened because it all seemed legit -- we were both going all-in, we had the exact share split in writing, did reverse vesting, received founders stock, etc. I even noticed that the shares seemed to exceed the total, and my business partner sent minor corrections, explicitly affirming I had the most shares of anyone. You have to trust your business partner at some point.
Legally speaking, my business partner secretly created a small equity pool for all co-founders excluding himself. There was no reason to believe we were in a pool, since co-founders split the entire pot.
This caused the percentages to seem about as expected. To the best of my knowledge, there were only two tells in the written contract:
1. The total shares were listed as ~1M, which at the time sounded perfectly logical. Unbeknownst to me, this was only the shares in the pool. I now know that startups often first allocate 10M shares, apparently for psychological reasons.
2. The vesting documents were titled an "equity incentive plan". At the time, this made perfect sense to me; the entire reason for us all reverse vesting is to provide incentive to stay. However, I now know this specific phrase often indicates an equity pool.
I recommend all founders speak with the lawyers jointly, instead of delegating it to the CEO. Ideally, also pass the contract by a startup-savvy lawyer. (In our case, one of our co-founders showed a CPA who said everything looked normal.) I recommend not signing until the exact cap table with zero errors is jointly signed. (As I mentioned above, I pointed out a mistake to my business partner then signed after he replied I had the most equity.) I also recommend contacting your business partner's references if you haven't worked together, especially since they will be providing those to VCs later.