I have the following code on a button:

<input type="submit" name="LabelGenericRecall" value="Recall" onclick="document.Form1.View.value=0; ButtonOperation(this);"
 id="LabelGenericRecall" style="width:150px;" />

The code of ButtonOperation() is this:

function ButtonOperation(toButton,tcUrl,tcMessage)
{
   lcMessage=''
   lcUrl=''
   if (tcUrl==null)
   {
      lcUrl=''
   }
   else
   {
      lcUrl=tcUrl
   }
   if (tcMessage==null)
   {
      lcMessage=''
   }
   else
   {
      lcMessage=tcMessage
      lcMessage=lcMessage.replace('\\','\\\\')
      lcMessage=lcMessage.replace("'","\\'")
      lcMessage=lcMessage.replace('"','\\"')
   }
   if (lcMessage.length>0)
   {
      if (confirm(lcMessage))
      {
         toButton.disabled=true
         if (lcUrl.length>0)
         {
            location.href=lcUrl
         }
         else
         {
            loForm=document.getElementById("Form1")
            loForm.submit()
         }
      }
   }
   else
   {
      toButton.disabled=true
      if (lcUrl.length>0)
      {
         location.href=lcUrl
      }
      else
      {
         loForm=document.getElementById("Form1")
         loForm.submit()
      }
   }
}

So, basically, in there, once the click is done, toButton.disabled becomes True.

However, a user has succeeded to submit two transactions at the same time. So, this means he succeeded to click so fast that the second click was performed before toButton.disabled=true was executed.

I tried to simulate that and was not able to. Anyone would have any idea on how he could have succeeded?