I have had several customers who have been able to make changes to previously placed orders. Even though the order status is set to pending after checkout is complete and their payments are processed, they are able to go back into the shopping cart (which should be empty but is not) and delete items from the cart. They then believe that the payment amount will be adjusted to reflect the new total of items left in the cart, but of course it will not, as the original amount has already been charged to their card by Elavon. Why does the cart still contain items already ordered? How do I prevent this from happening?
This looks like a permission issue. Check the permissions page
admin/people/permissions and make sure only relevant roles can edit orders.
By default, only the following permissions should be granted to authenticated users, and to any customer role you may have created :
- Create Order orders, optionally Create orders of any type
- View own Order orders, optionally View own orders of any type
About the items remaining in shopping cart after checkout, have you tested yourself ? I'd more believe your customers edited orders from their orders page if they had permission to... Else, a custom rule or a custom module may cause that behaviour.
As explained in drupalcommerce.org
At the heart of Drupal Commerce is the ubiquitous Order. This Order is first created when a user adds a product to a cart. The Order is actually the "cart" when it has a status of "Shopping Cart."
Cart is only one of the possible states of an order.