Ok, was able to create a few situations where this could happens. The below for example.
1. Click to pay at quickpay, uses browser back navigation, refreshes basket, then clicks to pay at quickpay again
2. Click to pay at quickpay, closes the browser, comes back to site later, goes to pay at quickpay again
Both of those can trigger this issue. There maybe a few more, but my fix covers those as well. I've implemented the below for next release of CBSubs.
forge.joomlapolis.com/issues/8938
In short when the basket is rendered and the Quickpay Form parameters are being prepared I first check if the order id exists at Quickpay. If it does I use our existing cancellations incrementing code to increment the order id so it's now unique and no longer in use. This should resolve all existing order id issues from then onward.