The only thing that I can think of is that they may have stayed on the paypal site for more than 20 minutes and their session timed out and their cart was cleared.
I've updated your pp_confirm.php page so it will redirect them back to the empty cart in this case and not process the payment with just the shipping. The code I added is on lines 56-61.