Assumption #0: Vulnerability and resistance are 2 sides of the same coin and have a consistent application of concepts. Understanding one is at least instructive to adjudicating the other.
Assumption #1: For all resistances an vulnerabilities, the highest numerical value applies for any given damage type. Derived from "Not Cumulative", Rules Compendium (RC) pg. 224-226
Assumption #2: When determining damage, the damage is adjusted by the least resistance applicable and by the greatest vulnerability applicable. Derived from "Against Combined Damage Types", RC pg. 224-225 (Basically the damage always flows to where it will do the most damage.)
Assumption #3: Resistance or Vulnerability to "ALL" damage equates to a specific resistance/vulnerability to each damage type individually, as well as a specific resistance/vulnerability to untyped damage. Derived from "Combined with Resistance" pg. 226.
This last example under "Combined with Resistance" is particularly telling since the damage type is capable of activating each vulnerability by itself, but the damage is only modified by the greater of the two.
Skeolan has a well reasoned response to this question, but I have a objection to his second assumption. If the discrete damage was applied to each vulnerability in isolation, then the example on page 226 would result in 7 extra damage, not 5 damage as it describes in the RC. The application of multiple vulnerabilities stacking relies upon this assumption. In his defense, he answered before the Rules Companion was widely available, so he did not have the benefit of that change/example.
The interpretation of the rules that has the most consistency is that all vulnerabilities are considered in aggregate, not isolation and the damage is applied only once to the greatest applicable vulnerability.
This also mirrors the specific example of multiple damage types vs multiple resistance types under "Against Combined Damage Types" on page 224-225. Basically, resisting both types of damage dealt does not activate both resistances or provide additional protection the attack. Only the lesser resistance counts. In a similar way, being vulnerable to both types does not activate both vulnerabilities to make you more vulnerable, only the greater vulnerability counts.
Damage seeks to do the most damage, but each discrete instance of damage is only applied to one resistance and one vulnerability.
So to answer the original question (borrowing from Skeolan's breakout of case 2):
Outcome 1: 5 extra damage
Outcome 2a: 5 extra damage
Outcome 2b: 10 extra damage