For input validation failure: 400 Bad Request + your optional description. This is suggested in the book "RESTful Web Services".
For double submit: 409 Conflict
Update June 2014
The relevant specification used to be RFC2616, which gave the use of 400 (Bad Request) rather narrowly as
The request could not be understood by the server due to malformed syntax
So it might have been argued that it was inappropriate for semantic errors. But not any more; since June 2014 the relevant standard RFC 7231, which supersedes the previous RFC2616, gives the use of 400 (Bad Request) more broadly as
the server cannot or
will not process the request due to something that is perceived to be
a client error
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…