Say, I send 10 BTC from my account (holding 20 BTC) ABC to a vendor's account XYZ. Right after that, I send 10 BTC from my account ABC to the same vendor's account XYZ (consider I'd like to buy 2 products). We now have transaction t1 and transaction t2, which seem identical.
Besides the practical point of creating 1 transaction holding 20 BTC from ABC to XYZ, can t1 and t2 occur in one (valid) block? If so, why doesn't the malicious vendor not re-submit t1 infinite times untill my account has been depleted?
As far as I know you have to initiate the transaction, it is not a pull request from your wallet but more of a push. So a vendor has no control over receiving the funds and cannot run the same blockchain transaction multiple times as you described. Some vendors will give you different addresses to send payment to in order to differentiate new transactions. There is such a thing as a double spend, which requires many confirmations to counteract, but that's not what you're talking about here.