Hi,
I forgot to add: Have you considered using the authorise/capture model?
Basically in the SagePay plugin you can change the payment type from Payment to Authorise.
When SagePay processes the payment, it authorises it but does not debit the funds.
Then in the admin area of nopCommerce you click the Capture button to capture the funds.
This has a number of benefits:
If the customer completes the SagePay process, then the order fails (as in the behaviour you are seeing), no money leaves their account.
If a customer places an order you are unable to fulfil for any reason, you don't need to issue a refund as no money will be debited until the Capture button is pressed.
Hope this all makes sense - obviously it's not a solution to your problem, but it is a useful alternative way of handling your SagePay payments that I know a number of our clients use.
Regards,
Nick