We have some problems with users performing a specific action twice, we have a mechanism to ensure that users can't do it but somehow it still happens. Here is how our current mechanism works:

1. Client side: The button will be disabled after 1 click.
2. Server side: We have a key hash in the URL which will be checked against the key stored in SESSIONS, once it matches, the key is deleted.
3. Database side: Once the action is performed, there is a field to be flagged indicating the user has completed the action.

However, with all these measures, still there are users able to perform the action twice, are there any more safer methods?