use the session ID. Add a hidden element to the confirm page to set the invoice to the session ID:
<input type="hidden" name="invoice" id="invoice" value="<?php echo(session_id()); ?>" />
the IPN post back will also include this value. store the session ID in a column of the orders table to be able to look it up by the invoice value in the IPN post.