How to prevent fake drupalcommerce orders
Your problem is due to robots, in particular spam robots (spambots). I've monitored these pests closely on my site for some time, and found that spambots (such as XRumer) will click on anything that's clickable.  I doubt that you need to be concerned about spammers of the human kind.

There is nothing wrong with the suggestions from Strae, but don't expect spambots such as  Xrumer to respect tags such as rel="nofollow".  (Nice robots such as googlebot do, so if your fake orders are from nice robots only, this will fix it.).

In my experience, the single most successful measure to filter out spambots is to add effective CAPTCHA to the site.  If the user is not logged in yet, the CAPTCHA must be present in the order submit form.  If a new user register, the CAPTCHA must be present in the registration form.  (You don't need to use CAPTCHAs in the order submit form for logged in users). If you set up a CAPTCHA, don't bother with "math challenge", "leave this field blank" and "ReCAPTCHA" - XRumer knows how to solve those.

On my site, the Captcha Riddler is by far the most successful robot guard.  Even blatantly obvious "riddles", such as: "What is Justin Bieber's  first name?" stops the spambots.

PS: If your site is big enough, your "riddles" and their answers will probably be added to the knowledge base of XRumer and other spambots. But if you run a small site you will probably be able to fly under the radar for a long time with "riddles" you create yourself (and you just watch the logs and retire and replace any "riddle" that is cracked by a spambot).