Django's ForeignKey field is many-to-one. The fact that it happens not
to raise an error when you twist it slightly in the way you're doing
doesn't mean it's expected to work.
I'm not convinced there is a bug involved here, since you're not using
the ForeignKey class correctly. As far as I can work out, when
ForeignKey is used correctly, we always are going to be generating the
correct SQL.
I thought Django's "validate" management command raised an error when
to_field was used to target a non-unique field, but apparently I'm
hallucinating. That's probably an oversight in the implementation.
Regards,
Malcolm