Since 8/24 we have seen 11 duplicate GC recurrings caused by donors attempting multiple donations after their initial attempt (which they don't know were successful). Some donors indicated that they received error messages on the first attempt, others say they received no feedback from the form. The messages received include:
GC 6322742090 - 550 Permission Denied,
GC 362210930 - "I received a notice that access to that page was denied."
GC 4600617163 and 3976209062 - “Forbidden Page"
This may possibly overlap with https://phabricator.wikimedia.org/T105041. I will scan to make sure this is not also affecting one-time donations, but the 11 tickets we've seen about this have all come from recurring donors.
Updating story points to 4 to reflect work on automating refunds