One of my sites has starting duplicating orders on a regular basis. We had a customer specifically email us to tell what had happened. She said she submitted the order from confirm.php page, and was returned to the same page, where she hit submit again. Both orders went through. So she was not redirected to the order success page. I assume this is what has been happening with all the other duplicate orders. But it doesn't happen every time.
I recently had a problem come up where the checkout page somehow got extra code added that put the site into sandbox mode. You helped me fix that. I wonder if something happened to this page as well. Here is that thread: showthread.php?t=18119
I've attached the confirm.php page here.
Just got more information. This is what the customer also told us of her experience - "I never received confirmation on the website – it looked like some kind of hiccup loop. But I did get an email receipt after I wrote to you – just one, though." Two orders did go into payPay even though she got only one receipt.