You can check the session when the user returns to the success.html page. If you can't cross reference a payment for this session, you could then display an error or redirect the user.
When you use paypal as a payment provider they will normally send a seperate request to a different URL on your site verifying the payment which you can then cross reference when the user hits success.html to ensure that the user really had paid.
If you don't have this set up in your paypal settings, there is nothing to stop a user, or some device crawling after the user, from hitting the page.
Using the referer HTTP header is unreliable as it can be spoofed and many privacy-related browser extensions will either remove it or set it to an unrelated URL.