Have you tried adding the code in for regenerating the id like this:
This may help if the problem is a persistent session id. However the code and troubleshooting tips that have been posted already should also be clearing out the session for you.
To test to see if your session is being cleared out properly just after the session destroy code that you have put in this code:
This line of code should print out the contents of the session object and let you know exactly what is in the session at the end of this checkout success page.