Timing out could be an issue, but after reading more on d.o I realized that there seem to be issues of doing it this way with certain browsers? Also not having JS enabled would do this (but wouldn't that break Ubercart in general?)

One thought I had would be to add some kind of checks-and-balances using the form's token as a key. If more than one insert into uc_orders comes from the same form, then either just overwrite that order row (which is how regular forum and page editing forms work, from what I've read) or ignore the new insert altogether. That way it doesn't matter the client-side issues since it's taken care of on the server end.