Maybe the IPN from PayPal is inserting a duplicate. The PHP code protects against that, but if you've altered the way checkout works then the processing of IPN notices might not be able to detect the duplicate so is inserting a new order for you.
Affected files are:
/ipn_main_handler.php
/includes/auto_loaders/paypal.core.php (and all the files mentioned inside it)
/includes/modules/payment/paypal/functions_paypal.php

One quick test (assuming you're always getting duplicates, and can trigger the problem on-demand) might be:
1. Disable IPN Notifications within your PayPal Account
2. Then do a transaction that's previously been triggering duplicates and see whether a duplicate appears.

The downside to turning off the IPN notifications is that your store will not be notified of updates/alterations to transactions, such as refunds, or payments that weren't fully authorized until reviewed or captured. In those cases you'll need to manually add your own notes to affected orders and update the status of those orders whenever an update is done on the PayPal end (usually they email you, but not always).

Another test is to use the Admin->Customers->PayPal report to look at the activity related to those duplicate orders. The "memo" field of the paypal history record will say something like "Order added due to incoming IPN notice" when an order is created via IPN.



Unfortunately the v155 versions of the above files cannot be used on v154 without accommodating some db changes and some new functions that were added, so applying bugfixes would have to be done manually. (Notable fixes are changing $scheme to https instead of http, and changing $ipn_logging to ipn_logging).



That said, if you were to investigate the code in ipn_main_handler and paypal_functions to understand how it attempts to detect "new" vs "existing" orders and come up with more data to help identify duplicates, perhaps PayPal has been changing something that needs to be accounted for. This would require enabling debug logging within PayPal Express/Pro, and perhaps a manual override to trigger IPN logging in order to monitor how it's treating incoming transactions and determine whether it's missing certain signals that could help identify duplicates vs believing it needs to insert a new record.


Hope that's helpful.