So there are two rules:

1. No digit can appear more than twice, and
2. At least one digit must be duplicated.

So break it down into its cases:

m{
  ^
  (?= \d\d\d\d $ )  # ensure it's only 4 digits long
  (?:
      # first digit is the duplicated one
      (\d) \1 (?!\1) \d (?!\1) \d
    | (\d) (?!\2) \d \2 (?!\2) \d
    | (\d) (?!\3) \d (?!\3) \d \3

      # second digit is the duplicated one
    | (\d) (?!\4) (\d) \5 (?!\4|\5) \d
    | (\d) (?!\6) (\d) (?!\6|\7) \d \7

      # third digit is the duplicated one
    | (\d) (\d) (?!\8|\9) (\d) \10
  )
}x;
[download]

Now, that's just atrocious. It can be made a bit more efficient by grouping things together smarter:

m{
  ^
  (?= \d\d\d\d $ )  # ensure it's only 4 digits long
  (?:
      # first digit is the duplicated one
      (\d) (?:
          \1 (?!\1) \d (?!\1) \d
        | (?!\1) \d \1 (?!\1) \d
        | (?!\1) \d (?!\1) \d \1
      )

      # second digit is the duplicated one
    | (\d) (?!\2) (\d) (?:
          \3 (?!\2|\3) \d
        | (?!\2|\3) \d \3
      )

      # third digit is the duplicated one
    | (\d) (\d) (?!\4|\5) (\d) \6
  )
}x;
[download]

But we're still stuck with disgusting regexes. So... why use a regex? friedo's got a simple non-regex solution for you. The "pattern" you need to match isn't a pretty one.

Update: you could also use a far simpler regex that makes two passes at the string like so:

m{
  ^
  (?= \d* (\d) \d* \1 )
  (?! \d* \1 \d* \1 \d* \1 )
}x;
[download]