I don't see any code there that does anything to differentiate between a first post and a duplicate post. What you should do is redirect the browser to a different URL after processing the POST so that if they press refresh, they're not refreshing the target of the form and POSTing again.
