I have one very fidgety-fingered user who regularly 
double-submits msg because he presses the submit 
button again before the confirmation page is returned.

I had a little play myself: in this situation the onsubmit 
handler is firing, is alerting the user, and is returning 0 
(false) to abort the submission. 

IE6 ignores the result of the onsubmit and goes ahead 
and submits the form anyway.

The only way of getting IE to act on the onsubmit 
appears to be to set the return value using 
event.returnValue; either in the Javascript itself:

submitted = false;
function submit_once() {
    if (submitted) {
        alert("Your request is being processed.\\nPlease 
be patient.");
        <!-- JK workaround IE flaws. -->
        event.returnValue = 0;
        <!-- end JK workaround. -->
        return 0;
    }
    submitted = true;
    return 1;
}

or in the onSubmit attribute value:

onSubmit="event.returnValue = submit_once();"

It's not clear to me why IE ignores the return value or 
how returnValue is handled (or exists) in other browsers. 
Feels like another "don't want to go there" browser-
support issue to me -- feel free to close or ignore!