Wrong Order Total Sent to Authorize.net

[SallieRees]

We had a user places 3 orders relatively quickly. The order total in VM was always $2048.
The first order was pending and confirmed in VM, but $0 was sent to Authorize.net, then approved.
The second order was pending and confirmed in VM, but $0 was sent to Authorize.net, then approved.
The third order was pending only in VM, with $2048 was sent to Authorize.net and declined.
10.0.0.0.1 Coloring Pages 192.168.1.254
Any help on how to investigate this? I do have the raw logs, VM order, and Authorize.net transaction data.