upon returning from paypal, it is dropping the www from the address. the cart contents are stored in a session, the session cookie is domain specific, it's a different session when browsing the site using the www address versus not using www.
you can use an htaccess rule on your site to force all traffic to the www address to prevent this from happening:
force-www-htaccess.html