What's the purpose of secret message numbers in CAESAR ciphers?
DJB answers this question on the crypto-competions mailing list.

In short, the idea is that using counter as a nonce can leak information that would be better not leaked in real world conditions where an attacker may not have a copy of every message exchanged (or even if they do if e.g. a timestamp is used as counter).  However, using a counter also makes it much easier to reject replays without the protocol designer needing to include a separate counter.