Looks like it's possible for this to happen when using the Website Payments Pro API instead of the Payflow implementation. I'm not sure why though. There's no redirect in place to double pay and it blocks duplicate invoices in my tests. Have added a bug ticket and will debug further to see what's going wrong.
forge.joomlapolis.com/issues/7687
Notice for the duplicate payments on your site INVNUM in the request data when reviewing their notifications in CBSubs > Notifications are the same. This is supposed to stop it from paying that same invoice twice. This works fine in my tests, but I'm not sure why the duplicate payment isn't blocked in yours (we of course need to fix it even attempting a duplicate payment). Maybe a missing setting within your Website Payment Pro settings within your account?