Hmm.. that part of a form really only deals with moving an existing order to the post-checkout state's default status and invoking hook_order() w/ the submit $op. There shouldn't be a danger of duplicate orders anywhere.

Perhaps I can simply log in the order's data whether or not the submit has happened and not invoke the hook if it's already happened. Although, as of right now, there's no way for someone to checkout without JS enabled anyways.

I think I'll go ahead and make my solution a contrib pending review, since I'd like to put up a release candidate in the near future and don't want this to hold it up.