Is anyone still having this issue and able to provide steps to reproduce? I did notice that both of the original reports were using the UC Coupon module, but I can't really think what in that module would allow someone to checkout inappropriately. We're gonna need some help to locate this issue if it's something in core...