I think the secrecy can be maintained by collecting all the votes up until the last day of voting (or maybe 5 days after if going by postmark). As ballots come in, voter’s names are “checked off” as having submitted a (still anonymous) vote. If a ballot is received where the voter is noted as having already voted, any and all envelopes from that voter are set aside for resolution or investigation.

The voter can be contacted (email, phone call?) to let them know of the multi-ballot situation. Question: Can voter say “Oh, I didn’t know I sent it twice. Go ahead and vote the [first|last|neither] of them”? If no response by voter or they can’t be reached, all received ballots are returned or destroyed. Or is it better/safer to toss those ballots because the voter (or ballot box stuffer if that’s the suspicion) didn’t follow the rules?

At the designated ballot counting time, all verified ballots can be opened, separated from their envelopes, and counted per established procedure.

I agree with James Hogg’s comment that any new procedure should be voted on and not during an actual election (ie don’t make any changes right now). Good discussion.