Downloads allowing extra files in 1.2.4.1

My client is reporting that customers who purchase a certain downloadable PDF are also getting access to a second one. Sure enough, I tried doing some testing by uploading a couple of IRS tax form pdfs to make sure I only got the right one. Instead, when I "buy" only the first, I get:

Product Download: Link expires: Downloads remaining:
Download Now
Test report 1 (W-4)
2,985,332 bytes 06/01/2006 1
Download Now
Test report 1 (W-4)
69,242 bytes 06/01/2006 7

The first link gives access to a totally different file!

I'll probably proceed by either upgrading to 1.2.6 or trying to do debugging (researching how to turn on ZC debugging, or hacking at the PHP-level as needed). But I'm posting to ask for suggestions on which approach, or a totally different approach, will most likely be fruitful.

TIA,

Philip

Due diligence: Tried searching <download wrong>, <download wrong file> but results didn't appear relevant.

Minor update for archival purposes.... Problem appears to be with extra rows with ids beyond the max id in orders. I'm still getting it cleaned up though, i'll try to post exactly what I find.