I remember in the documentation it states that duplicates are possible -- that's just the nature of the internet. That's why it gives you a unique transaction ID. You're supposed to use that to prevent bad things from happening if you get notified twice.
A better question might be: why does it say Verified and then Invalid? Or is that ok?
EDIT
The docs say "PayPal sends a single word back, which is either VERIFIED if the message originated with PayPal or INVALID if there is any discrepancy with what was originally sent". I'm going to guess that YOUR code accidentally sends the "echo" back to PayPak twice and one of them is malformed. Maybe they're both identical but PayPal responds with INVALID if it gets it twice. But no matter, for a particular transaction Id, once you get VERIFIED, you're good. Simply ignore all subsequent responses.
EDIT 2
The return url is simply used by PayPal to redirect the user back to your site. Use this page to thank them for their purchase and inform them they will be notified once processing is complete. You can even set this to an empty string if you don't want this feature. When Payment is actually complete (or some problem was identified), PayPal will invoke the script referenced by the notify url. This is where you make sure everything looks right, handle duplicate notifications, update your database, send an email to the user saying their payment was processed, etc.