Hello. I have worked with osCommerce for over 8 years and am very familiar with it ([login to view URL])
Have worked with many payment options including all of the different Paypal options. Can stop double clicking (or 5, 10, people do get click happy sometimes) with Javascript to disable the button after first click so that further clicking does nothing.
Have worked with and customized Discount Coupons many times. Although...I don't quite understand what you're looking for to happen. If the coupon doesn't have an amount (monetary, percentage) what does that coupon do?
What version of osC are you running? ie, if it's fairly old, security patches is a whole lot different then just upgrading. But I do know quite a few. PHPIDS, SiteMonitor, general paying attention to permissions of files/directories. Get rid of define_languages and file_manager if you still have them, etc.