the problem is domain switching.
it happens when the address goes between using www and non www for the domain.
if a user starts browsing your site using the address:
and then paypal returns them to the www address
those are considered 2 separate domains and thus 2 separate browsing sessions. The items added to the cart in the non www address no longer exist when returned to the address using www
to prevent this, use mod_rewrite to force all traffic to use the www address: