See here: https://github.com/websharks/s2member/issues/1116
S2member credits account twice/sends new user registration emails and so on twice - once on transaction made (correct) and once on incorrect Transaction under review IPN message.
Best would be to introduce another new email so pending payments trigger an email to tell user that once payment is cleared further action will be taken.
(and account not demoted/changed beforehand - there must be like a 14 day grace period!!!)
Note - the bug is quite severe as Paypal Germany/Austria changed the way they handle incoming payments - Many (for me like 20%) are now marked as pending - usually complete within 1 hour - sometimes up to 23 hours. This is not about pending for echeck payments - it’s simply just another paypal thing to combat credit card fraud/hacked accounts it seems.