Just a quick thought. How about a select all on the order screen or an admin setting to purge orders that are older than a certain date and stuck in "checkout" -- basically, abandoned orders.
Also, you might consider a check that the same ip address can't submit some max number of orders in a given day, maybe user configurable. This would prevent a bot or worse from slamming your order table. Especially since a new order gets created every time you go back to the checkout page! Just trying to prevent somebody creating many bogus orders either maliciously or accidentally.
