The next version of Virtualmin will make it harder to end up with this misconfiguration (currently, if it detects even one domain configured with *:80, it will make all new domains with *:80…but, it’s usually just wrong…the one configured that way is probably a mistake, or the “default” site being accidentally or intentionally, but incorrectly, re-enabled).
So, to avoid it, don’t try to mix and match *:80 and IP:80 configurations. The way Apache decides what to display in such a case is utterly unintuitive, so you’re always gonna get it wrong.