I was having very similar issues and I was able to fix it. See this and this for my OG post.

I had changed from the PHP email method to SMTP/SMTPAUTH and duplicate orders started. Changed it back and not a single duplicate order.

Despite not being as secure and spam friendly as SMTP/SMTPAUTH, it works as it has for three years.