In general the form cache is supposed to be deleted after a form was submitted. Due to the condition in drupal_process_form() this doesn’t happen when the page cache is in effect.
Handling of the form cache was improved with the security fixes in 7.27, but I think this condition was forgotten. This means in some cases it’s possible to “finish“ multiple times by navigating back in the browser history then submitting the form again (with the same form_build_id).
I did not check whether this applies to later Drupal versions.
Even though I use webform to trigger the bug I do think this a Drupal core issue.
Setup
Reproduce
Change the condition to check for empty($form_state['build_info']['immutable'] instead of !variable_get('cache', 0).
Review & test patch.
None
None
None
Active
7.0 ⚰️
forms system
Here is a patch that implements the proposed solution.
Drupal 7 security support has ended as of 5 January 2025. This is the final extension of Drupal 7 end of life – Drupal 7 will no longer receive security updates or compatibility updates
See Drupal 7 End of Life → .