How do I prevent users clicking a button twice?

If you simply disable the button then ASP.NET won't post the form. Also you want to deal with client-side validation. Here's my solution:

<asp:Button runat="server" ID="btnSave" 
   Text="Save" OnClick="btnSave_Click" 
   OnClientClick="if (!Page_ClientValidate()){ return false; } this.disabled = true; this.value = 'Saving...';" 
   UseSubmitBehavior="false" />

See @Dave Ward's post for a description of UseSubmitBehavior.

If you have multiple validation groups you'll need to enhance this solution for that.

You must return true after the OnClientClick:

OnClientClick="this.disabled='true';return true;"

Any clicks in client-side must return true if the postback is to continue, it's a means of providing client-side validatin on button presses.