In a nutshell it seems that there are times when that error is due to a genuine problem, where the customer has spotted something is missing, don't like SagePay or forgot their password, etc...
...BUT... there's also a noticeable incidence of customers who have bookmarked the finishorder.php page and then returned to it, to check their order. Of course when they do this the system tells them that there's a problem (not what the problem is) and has you flying into a tizz, thinking it's all broken (hardly unfair given the ISC history

So, there you go... Still worth checking things out, but if there's no order, incomplete or otherwise it's most likely just them revisiting a poor choice of bookmarked page.