With a custom approval workflow, we had the situation where the request was approved even though the final approver had not approved the request.
Neither timeout behaviour or cascading decisions by the same person were responsible. The requests were going to the last step in the workflow, then automatically being approved 30 minutes later.
There was an EX step in the approval workflow. It was being triggered multiple times.
Within an EX step a method "MakeDecision" is executed for a PersonWantsOrg object.
Depending on the decision (true or false) it switches the workflow to the next step.
But, this does not have to be the just next step in the approval workflow. It increments the workflow step by 1 each time. So in this case the final approval was reached in error.
Typically an EX step depends on a scheduled process, that looks for the external approval.
If there is nothing in the process to check if the approval has already been registered once, it will call the method again each time the schedule runs, and continue incrementing the status of the approval workflow in error.
A possible way to achieve this is to check PersonWantsOrg.Ident_PWOState as this attribute gets changed as the approval status changes. (If there are several steps, it may be necessary to populate this field with a custom value, so that your script can check for that specific state)