Interesting!

I had the same issue and found out that the session data was overwritten in those cases. This is possible because zen cart does not lock the sessions when they are stored into the database. And the double POST submit now explains why it happened so often.

Since I store the sessions in files (then session locking works automaticly), I haven't had any double orders in about 4 months (before I had at least several a week). I also described it previously here: http://www.zen-cart.com/forum/showthread.php?t=82029

Note that it might not be safe to use file based sessions on shared servers.