On submit all and finish, initialise
$SESSION->quizattemptjustfinished[$attemtp->id] = array('key' => random_string(10), 'time' => time());
to the URL of the review page. That marks that this is a review 'immediately after the attempt'. On each hit of the review page, update the 'time'.
Then on 'Finish review', delete that entry from quizattemptjustfinished.
When validating the key, if too much time has passed since the last recorded 'time', delete this entry from quizattemptjustfinished - that is necessary for when people just close the browser window.